On-chain data: Pando Rings hacker bought 7,548 ETH, of which
According to monitoring by Ember, the hacker who stole about $22 million in assets from Pando Rings four years ago bought 7,548 ETH with 16.98 million DAI at an average price of about $2,249 after the market decline triggered by the Binance hack; about two hours later, 4,000 of those ETH (about $9.22 million) were transferred via Tornado Cash. PANews and Wu Shuo both cited the same set of on-chain data.
Event Timeline
- [11-02 04:07] Pando Rings hacker bought the dip and purchased 7,548 ETH, then laundered away 4,000 ETH via Tornado (PANews)
- [11-02 04:12] Pando Rings hacker bought 7,548 ETH, then transferred 4,000 of them to Tornado Cash (Wu Shuo)
Background and Impact
On November 2, 2026, PANews (04:07) and Wu Shuo (04:12) successively reported the same on-chain move: according to Ember's monitoring, the hacker who stole about $22 million in assets from the Pando Rings project four years ago bought 7,548 ETH with 16.98 million DAI at a purchase price of about $2,249 after the market decline triggered by the Binance hack three days earlier. About two hours earlier, shortly before the reports were published, the hacker transferred 4,000 of those ETH (about $9.22 million) via Tornado Cash. The core figures from the two sources match: 7,548 ETH, 16.98 million DAI, $2,249, 4,000 ETH and $9.22 million; the only wording differences are that PANews wrote “Tornado” while Wu Shuo wrote “Tornado Cash,” and the purchase price was written as “$2,249” and “about 2249 USD,” respectively.
The background of the incident dates back four years: the Pando Rings project was hacked, involving about $22 million in assets, and these funds have since been controlled by that address. The timing of this operation coincides with the market decline triggered by the Binance hack: according to the sequence given by the monitoring party, the hacker completed building the position within three days after the decline occurred, buying 7,548 ETH and using 16.98 million DAI. It should be noted that the available material only describes the chronological relationship and does not state that there is a causal or other connection between the hacker's buying and the Binance hack, nor does it disclose the specific source of the 16.98 million DAI.
From an on-chain tracking perspective, moving assets into Tornado Cash is a common step in disposing of such funds. Tornado Cash severs the direct correspondence between addresses through mixing, making continuous tracking of subsequent funds more difficult; therefore, once funds transferred out of the hacked address enter this protocol, traceability usually drops significantly. The 4,000 ETH moved this time, worth about $9.22 million, are part of this 7,548 ETH position; as of the reports, no disclosure of further action on the remaining portion was seen. For the market, the information provided by the material is limited to the buying and transfer by a single address; it involves neither selling nor a direct impact on spot prices, so it is inappropriate to infer price direction from it.
Follow-up points worth watching are updates to the address tracking by the monitoring party (Ember), and whether the remaining ETH at that address continues to enter the mixing process; as of publication by both sources, neither mentioned any response from the project team, law enforcement agencies or exchanges. This type of event will also prompt users to re-examine trading entry points and account security, including the registration and download processes for channels such as Huobi HTX registration and APP download, Gate.io registration and APP download, Bitget registration and APP download, Binance registration and APP download, and OKX registration and APP download, as well as basic settings such as two-factor authentication. This article only compiles public on-chain information and does not constitute any investment advice.
FAQ
### Does transferring to Tornado Cash mean these funds can never be traced again?
That cannot be asserted. The material only shows that 4,000 ETH (about $9.22 million) were transferred to Tornado Cash; the protocol weakens the direct correspondence between addresses and increases tracking difficulty, but that does not mean the funds cannot be analyzed. Whether they can be linked later depends on further work by the monitoring party and on-chain analysis firms.
### What is the relationship between the hacker buying ETH and the Binance hack?
The material only states that the buying occurred within three days after “the market decline triggered by the Binance hack,” at a purchase price of about $2,249 using 16.98 million DAI; it does not state that there is a causal or other connection between the two, nor does it disclose the source of the DAI funds.
### How much of this 7,548 ETH has not been moved?
The material only discloses that 4,000 of them were transferred to Tornado Cash; as of publication, no explanation of further movement of the remaining portion was seen. Because neither source mentions where the remaining amount went, the specific balance and subsequent handling require updates from the monitoring party.