Dormant wallet buys 1,734.1 ETH, then deposits into Tornado Cash
The short answer
A wallet described as possibly linked to hackers spent 4.16 million DAI to buy 1,734.1 ETH after more than three years of dormancy, then deposited the ETH into Tornado Cash, according to Lookonchain monitoring reported by PANews and Odaily on November 5. Odaily published its report at 21:18 SGT. Both outlets attribute the observation to Lookonchain; the reports do not establish the wallet owner's identity or a new theft.
For an ETH holder, the useful distinction is between a reported purchase and the destination of the purchased coins. The sequence gives a reason to examine the transaction trail before calling the purchase accumulation. It does not establish an exchange inflow, a change in the wider market's demand or an effect on your own account. PANews reports the purchase and subsequent deposit.
Show less
What the wallet report actually says
The reported sequence has three parts. A wallet inactive for more than three years became active. It spent DAI to acquire ETH. The acquired ETH then went into Tornado Cash. Odaily identifies the wallet only with the shortened address 0xd175...CEC5 in the readable report. That abbreviation is useful for recognizing the story, but it is insufficient for checking a complete address character by character. Odaily's November 5 report gives the same purchase amounts.
Article table: scroll horizontally, or focus the table area and use the arrow keys.
| Reported item | Amount or description | Attribution |
|---|---|---|
| Period of dormancy | More than three years | Lookonchain, reported by PANews and Odaily |
| Asset spent | 4.16 million DAI | Same observation |
| ETH purchased | 1,734.1 ETH | Same observation |
| Subsequent destination | Tornado Cash | Same observation |
| Connection to hackers | Possible | PANews and the qualified wording in Odaily's body |
The qualification belongs beside the identity claim. A headline that simply called the wallet a confirmed hacker would strengthen the source's wording. Likewise, the purchase amount cannot be presented as a newly confirmed loss. The reports describe money moving through a wallet; they do not publish a new victim's loss calculation.
The time also needs a precise label. The 21:18 SGT timestamp is the time of Odaily's report, not a verified execution time for every transaction in the sequence. The report does not provide a transaction-by-transaction timetable. Readers comparing it with another market screen should keep those two kinds of time separate.
The arithmetic behind the purchase
Using the reported totals, 4,160,000 DAI divided by 1,734.1 ETH gives approximately 2,399 DAI per ETH. This is our calculation from the rounded aggregate amounts. It is not a live ETH price, a dollar valuation independently checked at publication, or a record of the price of each individual fill.
The denominator is the ETH acquired. The numerator is the DAI reportedly spent. Dividing one by the other answers how much DAI the reported purchase used for each ETH in aggregate. A claim about execution quality would require more detail, including the individual trades and their timing. Neither short report supplies that breakdown.
Keeping the units visible avoids another mistake: replacing DAI with dollars without checking the conversion. The source gives a DAI amount. This article retains that unit in the arithmetic. It also avoids using the result as a current quote at which a reader could buy or sell ETH.
The purchase and the later deposit should be read together. A purchase can describe a conversion between assets. Whether it also represents a decision to hold ETH for an extended period depends on what happened next and on evidence about the owner's intent. Here, the next reported action is a deposit into Tornado Cash, so an accumulation narrative would leave out part of the story.
Two articles, one monitoring origin
PANews and Odaily both name Lookonchain. Their agreement confirms that the same observation appeared in both publications. It does not turn the reports into two separate on-chain investigations. We have retained that attribution throughout, including the possibility, rather than certainty, of a hacker connection.
Odaily published a separate November 5 story about 885 ETH and a Ledger-related address. That figure is not part of this wallet's reported 1,734.1 ETH purchase. Combining the stories would create a total whose connection the sources do not establish. This article uses only the dormant-wallet sequence.
A fuller check would require complete transaction identifiers and addresses, along with the reasoning behind the wallet label. Those details would let a reader compare the purchase and deposit directly. The shortened address and the shared attribution support a narrower account: Lookonchain reported the sequence, and two outlets carried it.
Neither report establishes that a centralized exchange lost funds in this transaction. There is also no sourced exchange suspension or account restriction in this story. An ETH holder should avoid interpreting the wallet's activity as evidence that a particular exchange account has been compromised.
How to examine an ETH transfer record
Ethereum's transaction documentation explains that submitted transactions include sender and receiving addresses, the value transferred and information governing the gas fee. It also distinguishes a transaction waiting in the pool from one selected by a validator and included in a block. A transaction hash identifies the submitted transaction. These fields give a reader a way to check a transfer without relying on a wallet label in a headline. Ethereum's transaction documentation describes the fields and lifecycle.
For a transfer you recognize, preserve the full identifier supplied in your own transaction record. Compare the sending address and receiving address with the transfer you intended. Record the asset and the network shown by your service. If the record points to a contract, distinguish that destination from a simple transfer to another externally owned account; Ethereum's documentation explains that a transaction addressed to a contract executes contract code.
Keep the amount transferred separate from the transaction's fee. The documentation treats value and gas-related fields separately. A figure attached to a wallet movement should not automatically be interpreted as the recipient's net proceeds or as the amount lost by someone else.
A transaction awaiting block inclusion and a transaction already included in a block are different states. When following a transfer, record the state you actually see. Do not treat the existence of a hash alone as proof that the whole process, including any receiving platform's own account credit, has finished.
Ethereum also describes how an included block progresses to justified and finalized states. This gives a more precise vocabulary for following a transfer than treating every visible record as equally settled. If you are comparing observations made at different times, preserve the state each observer saw. A later screenshot may show a different stage without describing a different transaction. The public news reports do not provide these stages for the wallet activity, so the transaction-lifecycle explanation is a method for checking records, not additional confirmation of this event. The transaction hash should remain attached to each observation as you follow it.
What this means for you
If you hold ETH on an exchange such as OKX, start with your own account records. The wallet report supplies no instruction to change an unrelated position. These are practical checks derived from the distinction between a reported public movement and your private account activity:
- Open the relevant deposit or withdrawal record and compare its network, destination, amount and transaction identifier with the transfer you authorized.
- Check whether the record is pending or completed before deciding how to follow up. Keep the identifier and the displayed state when contacting the platform about a transfer.
A person monitoring an ETH position can also use the funding-rates board to examine the market information displayed there. Funding data answers a different question from the origin of a particular wallet's funds. No current funding figure, liquidation total or price reaction is attributed to this wallet report.
If your account contains an unfamiliar movement, focus a support query on that movement's own record. The dormant address in the news is not evidence of who authorized a transaction in your account. Keeping the records separate helps prevent a broad security headline from replacing the details needed to investigate a specific transfer.
Quick answers
Did the wallet buy 1,734.1 ETH with new money entering crypto?
The reports say it spent 4.16 million DAI. They do not establish where that DAI originally came from or whether the transaction represents new capital entering the market. The supported statement is an asset purchase followed by the reported deposit.
Does this establish that a hacker stole 1,734.1 ETH today?
No new theft of that amount is established in the opened reports. PANews describes the wallet as possibly linked to hackers. The amount refers to ETH reportedly purchased with DAI, not a verified new loss.
Is approximately 2,399 DAI a current ETH quote?
It is the result of dividing the reported DAI total by the reported ETH total. It summarizes those amounts and should not be substituted for a current executable quote.
What would make the account more conclusive?
Complete transaction identifiers, the full wallet address and evidence explaining its attribution would permit a direct check of the sequence and the identity claim. The next useful update would supply those records or clarify the attribution, rather than repeat the same purchase amount with a stronger label.