A suspected $106 million hack of an EU entity's cryptocurrency exchange accounts came to light on Monday, November 2, when on-chain investigator ZachXBT tied a wallet that bought 27,553 ETH overnight — a purchase many observers had read as a bullish whale — to the stolen funds.

At first, the buying looked like good news. At 01:17 UTC, on-chain analytics account Lookonchain flagged "whales buying ETH like crazy," noting that wallet 0x9EcA had spent $37.96 million in USDC to purchase 16,658 ETH within two hours. By the time the buying stopped, the wallet had spent a total of $62.97 million at an average price of $2,286 per ETH.

The gap between those two readings is how on-chain monitoring usually unfolds: analytics accounts surface large transfers the moment they happen, while tying a wallet to specific stolen funds takes tracing work across exchange records and wallet hops.

The funds behind the purchases came from at least three centralized exchange accounts. A tracing map credited to ZachXBT, the investigator Specter, and the analytics firm TRM shows the USDC leaving those accounts on Sunday, passing through dozens of freshly created wallets, and landing in 0x9EcA.

That stablecoin-to-ETH swap was a telling detail. Circle can freeze USDC at the issuer level, but nobody can freeze ETH, so converting stolen stablecoins into ETH within hours is a standard first move after a theft.

No victim has been named, and none of the exchanges involved has commented, leaving the identity of the EU entity and the exact circumstances of the theft publicly undisclosed.

Whales are buying $ETH like crazy on-chain!

Over the past 2 hours, whale 0x9EcA spent 37.96M $USDC to buy 16,658 $ETH at an average price of $2,279.

The whale is still buying! pic.twitter.com/okLzKm9c5h

— Lookonchain (@lookonchain) November 2, 2026

Where Is the ETH From the Suspected Hack Now?

The coins have been spread out and are partly still sitting in place. The Ethereum ledger shows 0x9EcA passing almost all of its ETH on within hours of buying it:

• Nov 1, 23:46 to Nov 2, 00:26 UTC: 15,085 ETH sent to wallet 0x65C3…b841 in eight transfers
• 00:40 to 03:56 UTC: 12,033 ETH sent to wallet 0xBe95…a85a in 25 transfers
• 10:29 to 10:40 UTC: 0xBe95 emptied into two new wallets, receiving 6,217 ETH and 5,816 ETH respectively

Wallet 0x65C3 is drip-feeding funds onward. It has sent 3,100 ETH to a wallet that the investigators' map shows bridging funds to Tron, 2,358 ETH to another address, and smaller amounts to at least seven more. It also sent test amounts to the SwftSwap and Rango cross-chain services.

Each bridge or swap hop moves the trail onto a different system's records, which is why the tracing map stitches together exchange-account outflows and Ethereum transfers — and why any funds that reach Tron have to be followed on that chain separately.

As of 14:35 UTC, the wallet still held 7,844 ETH — about $18 million at the day's price of $2,290. The original 0x9EcA wallet keeps another 310 ETH.

Other portions of the suspected $106 million hack took different routes. The map shows USDC going straight to instant swap services and to the platforms Wagyu and Kyrrex, and some of it bridged out to Tron.

Could There Be Any Consequence for the Ethereum Price?

The overnight bid was real money, but it will not stay. ETH was trading at $2,290, up 1% on the day and almost exactly at the thief's $2,286 average purchase price, meaning the $62.97 million of buying added genuine demand overnight.

That ETH now represents a supply overhang. Bridges and swap services turn the coins into other assets, which means someone sells ETH on the other side of each hop — and roughly $18 million of it is still waiting in a single wallet.

Because the addresses are public, what happens next is directly observable: whether the roughly $18 million still parked in 0x65C3 moves onward, and whether the unnamed EU entity or the exchanges involved ever go on record. Until anything is confirmed, the on-chain trail remains the clearest public record of where the money has gone.