According to @EmberCN, an unidentified group sold 7,066 ETH on-chain for 23.945 million DAI about four hours before the post, at an average execution price of $3,389 (source: @EmberCN). According to @EmberCN, the ETH were withdrawn over the prior two days from Bitget and HTX using dozens of wallets, roughly 150 ETH per withdrawal, before being consolidated to five wallets for sale (source: @EmberCN). According to @EmberCN, the consolidation and sale addresses are 0x1d1468A8C4631E247119F3C5879E9c19Bd2A549A, 0xE11fDF9F4224AAc4415Bb8984870c545b6b3CEcc, 0x1C95f775bcEc41d171e74681ce3a88ac90487295, 0x0E46CFb8BFe2c33b9c1DC0a29905693c09ba1F1E, and 0xDd33FB44a471e0204BD279b7e8aB90776c28bF92 (source: @EmberCN). According to @EmberCN, the group used multi-wallet transfers in what was described as an attempt to avoid detection before selling (source: @EmberCN).

According to @OnchainLens, Richard Heart transferred 30,066 ETH (approximately $125.09 million) to a new wallet, with 29,804 ETH (approximately $124 million) routed via Tornado Cash, and cited the following addresses: 0x91E29CEA3CDe7866e679D19CC874d1196163230c, 0x1B5312E3E2ce21f65D0f1FB1785eCC0B392d1B1f, 0x0F92C105582b114145CD69d8a19eea5fB9A19749, and 0x7eecF3037B4b08f3f2198f6d59d5ca7eecaA723d (source: @OnchainLens on X, Oct 27, 2025). According to Tornado Cash documentation, the mixer obfuscates links between source and destination addresses, reducing traceability of subsequent ETH flows and complicating real-time sell-side monitoring (source: Tornado Cash documentation on GitHub). According to the U.S. Treasury OFAC press release dated Aug 8, 2022, Tornado Cash is under sanctions, implying centralized venues may apply stricter screening to related inflows, a factor traders consider when monitoring large transfers (source: U.S. Treasury OFAC press release, Aug 8, 2022). According to @OnchainLens, the disclosed addresses provide concrete points for on-chain tracking of any subsequent movements that could influence near-term ETH liquidity profiles (source: @OnchainLens on X, Oct 27, 2025).

According to @lookonchain, BtcTurk was hacked for more than $48 million in crypto assets. According to @lookonchain, the attacker is actively swapping the stolen funds into ETH on-chain. According to @lookonchain, the wallets linked to the exploit are 0x0fe41fe8786329fb6bd8f2baa73aa55e770f0951, 0xa041feb3a8297c5689fee180083164a061a17fd6, and 0x7D91D1ebeBA91257733a523409125aEdac5d8b6E. According to @lookonchain, this update was posted on August 14, 2025, enabling traders to follow further ETH swap activity directly from these addresses.

According to MistTrack_io, the hacker involved in the DEXX incident has transferred a substantial amount of 5,912.4 ETH to Tornado Cash. This move is significant as Tornado Cash is a privacy tool often used to obscure the trail of cryptocurrency transactions. Additionally, two Ethereum addresses associated with the hacker still hold balances: one address contains 4 ETH, while the details of the other address's balance were not fully disclosed.

According to MistTrack_io, the DEXX hacker has recently transferred 1,512.4 ETH to Tornado Cash, a privacy-focused cryptocurrency mixer. Despite this transfer, there remains a total of 3,149.55 ETH in specific Ethereum addresses linked to the incident. This situation indicates ongoing security and tracking concerns for traders monitoring the movement of these funds.