Suspected Hacker Address Moves 1,670 ETH Out of Tornado Cash
On November 8, Odaily 星球日报 and PANews successively reported, citing Lookonchain monitoring data, that over the past 20 hours, 1,670 ETH (worth $3.73 million) from Tornado Cash was deposited into Hyperliquid and then sold, buying 2,959 ZEC (worth $3.73 million). The data from the two outlets is consistent, both using the phrasing "suspected hacker" without further disclosing attribution.
Event timeline
- [11-08 10:01] Suspected hacker sold 1,670 ETH over the past 20 hours to buy 2,959 ZEC (Odaily 星球日报)
- [11-08 10:30] Suspected hacker exchanged 1,670 ETH transferred out of Tornado Cash for ZEC on Hyperliquid (PANews)
Background and impact
On November 8, two Chinese-language crypto media outlets successively reported the same on-chain anomaly. Odaily 星球日报 published at 10:01, stating that according to Lookonchain monitoring, over the past 20 hours, 1,670 ETH (worth $3.73 million) from Tornado Cash was deposited into Hyperliquid and subsequently sold to buy 2,959 ZEC (worth $3.73 million). PANews published a report on the same topic at 10:30, stating that over the past 20 hours, 1,670 ETH (about $3.73 million) was transferred out of Tornado Cash and deposited into Hyperliquid, then fully sold and exchanged for; the summary is truncated here and discloses no further details. Both outlets described the behavior of the relevant addresses as a "suspected hacker," but neither provided further attribution.
In terms of background, Tornado Cash has long been used to sever the traceable path of on-chain funds, and funds transferred out of it have historically been a key target of on-chain monitoring; Hyperliquid, as an on-chain trading venue, has fund flows that are visible to the public, which allows such position-switching paths to be fully recorded. It should be noted that the factual basis of both reports is the same Lookonchain monitoring data, constituting different retellings of the same source rather than two independent verifications. Based on the available material, the USD amounts corresponding to 1,670 ETH and 2,959 ZEC are both $3.73 million, meaning this position switch was equivalent in amount, and the entire operation took place within a 20-hour window.
At the level of interpreting impact, what can be confirmed is only the fund path: transferred out of Tornado Cash, entered Hyperliquid, sold ETH, bought ZEC. As for whether these funds are indeed hacker proceeds and why ZEC was chosen for the exchange, the material contains no conclusion, and both outlets used only the phrasing "suspected." For observers, the nodes worth tracking are whether this batch of ZEC continues to move afterward, whether it enters other trading venues in batches, and whether monitoring accounts such as Lookonchain update the movements of the relevant addresses.
No data conflicts are seen in this report: the token quantities, USD amounts, time window and trading venue are consistent between the two sources, with differences only in wording and completeness of disclosure: Odaily directly states "bought 2,959 ZEC," while PANews' public summary stops at "exchanged for." Some users who track such on-chain developments enter the corresponding platforms to view market conditions through channels such as Huobi HTX app registration and download, Zhima Gate.io app registration and download, Bitget app registration and download, Binance app registration and download, and OKX app registration and download; however, the aforementioned position-switching behavior itself does not constitute any trading advice.
FAQ
### Does this position switch mean the funds have been cashed out or "laundered"?
The available material can only confirm the path of funds being transferred out of Tornado Cash, entering Hyperliquid, and selling ETH for ZEC; it does not show how ZEC was disposed of afterward. Both outlets used the phrasing "suspected hacker" and gave no attribution conclusion, so it cannot be concluded on this basis that the funds have been cashed out or fully laundered.
### What nodes are worth watching going forward?
Three points can be tracked: whether this batch of 2,959 ZEC continues to be transferred and whether it enters other trading venues in batches; whether the relevant addresses on Hyperliquid have any new fund movements afterward; and whether monitoring accounts such as Lookonchain update the movements and attribution of this address cluster.
### Will this transaction affect the price of ETH or ZEC?
Neither report mentions price reaction, nor discloses the share of this transaction in the trading volume of the relevant markets. The material only shows that 1,670 ETH and 2,959 ZEC correspond to the same amount of $3.73 million, so the actual impact on ETH or ZEC prices cannot be judged on this basis.