Hackers are buying ETH, 3 wallets flip $38M DAI for Ethereum

Three wallets suspected to be owned by hackers converted $38 million worth of DAI stablecoins into Ethereum on Wednesday between 6:00 AM and 7:00 AM UTC, according to data from Lookonchain and Arkham Intelligence.

The “hacker” wallets executed several transactions in DAI and swapped them for Ethereum at an average price of $4,401 per coin. Lookonchain’s onchain records screenshots show the trades were routed through decentralized exchanges using CoW Protocol and Convex Protocol, platforms that facilitate large swaps fast with reduced slippage and fees.

Hackers make coordinated swaps through CoW and Convex protocols

According to records from Arkham Intelligence, the hackers did not convert all their DAI holdings in one move, but exchanged stablecoins for ETH in increments of up to $12 million. Analysts believe they were trying to reduce slippage and avoid raising suspicion on-chain while repositioning illicit funds.

Hackers are buying $ETH!

3 wallets (likely belonging to hackers) spent 38M $DAI to buy 8,637 $ETH at $4,401 7 hours ago.https://t.co/wSLJN03zPKhttps://t.co/eCQVmuzJ1Zhttps://t.co/Gwz5p6HOuH pic.twitter.com/7GGUebSqXl

— Lookonchain (@lookonchain) October 2, 2025

One of the addresses, beginning with 0x4Ee3, was seen liquidating more than $11 million worth of DAI into ETH within the one-hour window. The wallet sent 2,730 ETH valued at $12 million to a separate address while conducting smaller swaps in parallel.

The transactions included two large outflows of 4 million DAI and 5 million DAI, which were swapped for 906 ETH and 1,133 ETH, respectively. Another transfer included 2.5 million DAI exchanged for 567 ETH, before all the accumulated Ether coins were forwarded to new address 0xA0168e…B89faCb6, now currently worth $14 million at current prices.

A second wallet, beginning with 0x1c4, liquidated 521,000 DAI, 4 million DAI, and 5 million DAI, followed by a final conversion of 12.12 million DAI into 2,761 ETH. All of these funds were later consolidated and sent to other addresses, again routed via the CoW Protocol contracts. 

The largest of the three wallets, beginning with 0x272c, handled over $26.6 million in transactions during the same early morning period. 

Lookonchain’s screenshot showed the address swapped its holdings via Convex Protocol and converted 5 million DAI into 1,135 ETH. They later made a 12.12 million DAI swap, yielding 2,761 ETH. In total, the address accumulated 2,761 ETH worth $12.15 million, which was then sent to a wallet linked to the first address, 0x4Ee3.

The timing, size, and routing of the trades strongly suggest the three wallets were acting in tandem, breaking up the $38 million DAI liquidation into pieces to reduce visibility. In total, the wallets converted 8,637 ETH valued at approximately $38 million.

Blockchain analysts monitoring the flows say the activity fits the pattern of actors seeking to obscure the origins of illicit funds by splitting swaps into multiple tranches. But according to one user on X, the hackers could be banking on the Uptober market rally that has shot Ether’s price 13% up from its weekly lows, according to CoinGecko.

Ethereum price rebounds to $4,400 at October’s start

Ethereum was trading at $4,464 early Friday morning, hovering near its recent high of $4,529. Market analysts point to strong inflows into Ethereum exchange-traded funds (ETFs) as a stabilizing factor.

Nine US-listed ETH funds recorded inflows of 14,864 ETH, worth $65.6 million this business week. These institutional purchases may have helped absorb selling or deterred bears pushing for a downward volatility spiral.

Ethereum recently rebounded from a low of $3,900 on September 26, a level some traders are now calling a potential market bottom of the year 2025. Patterns known as the “Power of 3” suggest the possibility of an 80 to 100 percent price increase by the end of the year.

TradingView’s market analysis suggests that Ethereum is in a neutral-to-bullish zone, supported by a level at $4,200 and resistance at $4,600. The Relative Strength Index (RSI) stands at 43.1, indicating neutral strength but no signs of being overbought or oversold.