Pando Rings Wallet Sends 4,000 ETH Through Tornado After 7,548 ETH Purchase
The short answer
A wallet identified by analyst Ember as the Pando Rings hacker sent 4,000 ETH through Tornado, according to November 2 reports from Odaily and PANews. The reports value that transfer at about $9.22 million and say the wallet previously spent 16.98 million DAI to acquire 7,548 ETH at an average reported price of $2,249. For an ETH holder, the immediate question is whether a transfer represents an exchange sale; these reports describe a Tornado movement and establish no exchange sale.
Odaily published at 12:05 Singapore Time (SGT) on November 2. Both outlets cite Ember, so their matching accounts share one underlying observation. Odaily's report provides the quantities and publication time. PANews' account carries the same wallet activity. The amounts below remain attributed to that observation; we have not independently reconstructed the transactions.
Show less
The transfer and the purchase answer different questions
The purchase concerns the wallet's acquisition of ETH. The later movement concerns where part of that ETH went. Odaily and PANews describe 16.98 million DAI spent for 7,548 ETH, followed by 4,000 ETH moved through Tornado. Keeping those actions separate prevents a transfer alert from becoming an unsupported claim that the holder sold everything it bought.
The reported transfer accounts for about 53.0% of the reported purchase quantity: 4,000 ÷ 7,548 × 100. The numerical difference is 3,548 ETH. That subtraction is useful for comparing the two reported amounts, but it does not establish a current wallet balance. Other transfers, separate addresses or subsequent transactions would require their own records.
A trader reading only “4,000 ETH moved” might ask whether that amount is about to reach the market. The available articles do not identify a receiving exchange, an executed sell order or a later destination. A transaction into Tornado cannot be turned into a confirmed sale simply because the amount is large. Keep any sale conclusion pending until a source identifies the sale itself.
The distinction also matters in reverse. The earlier purchase is one attributed wallet's activity. It cannot establish that ETH holders generally were buying, that institutions entered the market or that a price floor formed. Those are separate market claims requiring evidence beyond the wallet described here.
Read the three money figures on their own terms
The reports contain three different measures: the DAI used for acquisition, a stated average purchase price and a dollar valuation attached to the later ETH transfer. They describe different parts of the account. None is a complete profit statement.
Article table: scroll horizontally, or focus the table area and use the arrow keys.
| Reported item | Figure | What it describes |
|---|---|---|
| Acquisition spending | 16.98 million DAI | Amount the reports say was spent |
| ETH acquired | 7,548 ETH | Quantity attributed to the purchase |
| Average purchase price | $2,249 | Average quoted by the reports |
| ETH moved through Tornado | 4,000 ETH | Quantity attributed to the later movement |
| Transfer valuation | About $9.22 million | Value assigned in the reports |
Source for the table: Odaily's November 2 account.
Dividing the reported transfer valuation by the transferred quantity gives an implied valuation of $2,305 per ETH: $9,220,000 ÷ 4,000. This is arithmetic on a rounded report. It is not a new market quote, a realized selling price or a price readers can expect on an exchange screen.
Multiplying the reported average acquisition price by the full purchase quantity gives $16,975,452: 7,548 × $2,249. That is close to the rounded 16.98 million spending figure in the reports. The calculation compares the reported numbers; it does not establish the DAI exchange rate, transaction fees or the exact execution records behind the average.
For the 4,000 ETH portion, multiplying by $2,249 gives $8,996,000. Subtracting that from the reported $9,220,000 valuation gives $224,000. This is a comparison between a reported average cost and a reported transfer valuation. Calling it realized profit would require a sale price and evidence that the coins sold, neither of which appears in the opened reports. We therefore do not treat that difference as money the wallet earned.
The time is approximate, and the attribution matters
Odaily says the Tornado movement occurred two hours before its report. Its displayed publication time is 12:05 SGT, which places the movement at roughly 10:05 SGT by the report's relative wording. An exact transaction timestamp is not supplied in the readable report, so “roughly” belongs with that estimate. PANews also uses a relative two-hour description.
The outlets identify the actor by reference to the Pando Rings theft about four years earlier, involving approximately $22 million. That identification comes through Ember's monitoring, as presented by the outlets. The pages opened for this article do not supply a complete independently checked transaction trail proving the attribution.
For readers keeping an incident log, record the publication time separately from the estimated movement time. If a later report supplies an exact transaction timestamp, replace the estimate in the log while preserving the source of the earlier observation. Do the same for the wallet label: keep the analyst attribution attached to the name instead of turning it into an independently established identity.
The two outlets' agreement is useful for checking that the figures were reported consistently. It adds no second independent on-chain measurement. A later article citing either outlet would still be reporting the same observation unless it provides a separate transaction analysis. Count the evidence by origin when comparing follow-ups.
What an ETH trader can check in an existing account
Begin with the action actually reported. The new item is a 4,000 ETH Tornado movement after a reported 7,548 ETH acquisition. If an alert or chat message rewrites it as an exchange deposit or sale, ask for the receiving exchange or execution evidence before using that version of the event.
- Open the existing ETH order or position you are reviewing. Match the asset and trading pair with the account record; do not substitute the report's $2,305 implied valuation for a live order price.
- Read any pending transfer in the account's own transaction history. Compare its network, destination and recorded status with the instruction you submitted. This report does not say that an ordinary user's transfer is connected to the Pando Rings wallet.
- If you are assessing market effects, separate the wallet observation from market measurements. Record the observation time, then examine the price or position data for the same period before describing any response.
For a distinct question about derivatives, the funding board and liquidation board provide reader navigation. No figures from those pages are used in this article. A change visible on one of those boards would need its own recorded timestamp before being compared with this transfer.
There is no exchange withdrawal suspension, deposit instruction or account migration notice in the opened Pando reports. This article therefore offers no instruction to move funds to a different venue. For an existing transfer problem, use the transaction details and the service's own support route rather than a message claiming to offer recovery for this incident.
If you see a screenshot quoting “$9.22 million sold,” compare it with the underlying report. The source assigns that value to ETH moved through Tornado. Preserving the verb matters as much as preserving the amount. A screenshot that changes the verb changes the claim.
Why “buys the dip” does not establish a trading signal
PANews uses “buys the dip” in its headline. The underlying fact is the reported acquisition of 7,548 ETH at an average $2,249. The wording describes how the outlet frames the purchase. It does not demonstrate that the buyer knew the next market direction, that this was the lowest available price or that another trader could reproduce the entry.
Our reading is narrower: the report describes a purchase followed by a movement of part of the acquired quantity. An inference about conviction would need evidence about why the wallet bought. An inference about future selling would need evidence about the next destination or a sale. The articles provide neither a statement of intent nor a complete account of subsequent activity.
A holder considering a new order can keep the report as a wallet event in a watchlist. The order still needs its own price, quantity and execution conditions. The reported average purchase price belongs to the attributed historical acquisition; it is not an instruction for another account.
The approximately $22 million historical theft figure also has a different scope from the current $9.22 million transfer valuation. Subtracting one from the other would not calculate remaining stolen funds. They concern different dates and different measurements, and the reports do not provide the asset inventory needed to connect them that way.
What would make the next update substantive
A follow-up can add an exact transaction hash and timestamp, an independently checked destination or a documented exchange deposit. A confirmed sale would answer a different question from the movement now reported. Each new claim should identify the record supporting it, including whether it comes from Ember again or a separate investigation.
The current open questions are the exact transaction trail behind the wallet attribution, the subsequent destination of the moved ETH and whether any ETH was sold. The 3,548 ETH difference between the reported purchase and movement remains arithmetic, rather than a verified holding. These are specific gaps in this event's record.
For now, keep the quantities with their verbs: 7,548 ETH reportedly acquired, 4,000 ETH reportedly moved through Tornado. When reviewing a pending order, use the price and status shown in that account. When reviewing this incident, look for the next transaction record that adds a destination or an execution, rather than another headline repeating the same numbers.
Quick answers
Does $9.22 million mean an exchange received that amount?
The reports use that figure to value the 4,000 ETH moved through Tornado. They do not name an exchange receiving those funds. A later exchange destination would need a separate transaction record.
Does the 3,548 ETH difference establish a holding?
It is the difference between the reported acquisition and transfer quantities. Establishing a balance would require the other transactions and an identified observation time.