The aftermath of the security incidents related to Pando Rings has not yet dissipated, and the address marked as a hacker's address, 0x303D...3d9F, has once again been thrust into the spotlight: Lookonchain discovered that this address quietly purchased 7,548 ETH approximately two hours before several media reports were released, valued at about 16.72 million USD at the time. Multiple Chinese crypto media outlets quickly referenced this unusual bulk purchase, making the act of "hackers accumulating large amounts of ETH" itself a chain action worth tracking. On the same timeline, the Binance hot wallet attack that occurred in the early hours of October 30 was even more impactful—according to BlockBeats, the wallet controlled by the attacker received approximately 175 million USDT and reserved 2 ETH as Gas for subsequent transactions. However, despite already holding these 2 ETH, they still paid the Gas fees through MetaMask Gas Station, which was flagged by protocol engineer Justin Kalland as potentially leaving logs associated with the requests on the server side, thereby technically allowing for the possibility of correlating IPs. However, whether this step actually exposed the attacker’s identity is still just speculation. It seems that hackers in both incidents attempted to quickly complete their harvesting and withdraw: one side made significant purchases of ETH, while the other calculated the source of each Gas fee, yet every repositioning and every fee accumulated traces available for analysis, and the inquiries surrounding "who is paying ETH for the hackers" and "who is paying Gas for the hackers" are the tracking and counter-tracking games to be unpacked later.
7548 ETH Bulk Purchase: Hacker's Sudden Accumulation
Just when the address 0x303D...3d9F, which has been identified as related to the Pando Rings security incident and is under scrutiny, appeared again, a sudden heavy blow surfaced on-chain. According to monitoring by Lookonchain, this address marked as a “hacker” suddenly concentrated its buying of 7,548 ETH about two hours before related news was made public, estimated at approximately 16.72 million USD based on market price, representing a significantly large initial position. As PANews, Odaily Planet Daily, Foresight News, and other media outlets referenced this on-chain data, this purchase quickly turned from an "ordinary transaction" into a new focal point in the spotlight.
From the common post-mitigation paths, attacked funds are typically dispersed, mixed, or hedged to mitigate risks swiftly, and the reverse bulk accumulation of ETH during periods of public scrutiny seems unusual. One possible motivation is to attempt to convert some chips into more mainstream and liquid assets, while it cannot be ruled out that this is a high-risk bet on subsequent market trends, or perhaps a high-profile operation to interfere with external judgment regarding the true whereabouts of the funds. These remain speculative, but it is certain that this concentrated purchase of 7,548 ETH has constituted a new anchor point on-chain, providing a clear and public observation coordinate for tracking the subsequent flow of funds and asset status related to this address.
Conversion of Stolen Funds to ETH Position Significance
From habitual practice, converting stolen chips to ETH is primarily a “chip-swapping” decision rather than an “disappearance act.” ETH, as one of the cryptocurrencies with the highest market capitalization and liquidity, has deeper depth and higher acceptance, making it easier for subsequent reallocation, repositioning, and traversal between different ecosystems. Concerning the Pando Rings incident, this purchase of 7,548 ETH associated with address 0x303D...3d9F essentially bundles project-specific assets that originally had very clear directional attributes into a more mainstream and universal value carrier.
However, changes in technical pathways do not equate to “tracking difficulty zeroing.” Switching from project tokens to ETH does indeed alleviate subsequent analysis from having to rely on the liquidity structure of a niche asset, requiring a shift towards tracing transactions, splits, and cross-chain paths around mainstream assets; nevertheless, the addresses, amounts, and timestamps of these ETH inflows and outflows remain exposed on the public chain, reserving long-term usable evidence chain space for continuous monitoring of this cold wallet, comparison with other suspicious addresses, and even future collaboration with judicial investigations. Especially given that the address has been marked by Lookonchain and amplified by multiple media outlets, compliance institutions and leading trading platforms typically build warning and cooperation mechanisms around such high-risk addresses and large ETH movements, rendering this position increasingly "mainstream," and its "visibility" in regulatory and risk control systems might paradoxically be higher.
175 Million USDT Incoming: Attackers' Chip Layout
According to BlockBeats, shortly after the Binance hot wallet was attacked, the wallet controlled by the attacker received around 175 million USDT and reserved 2 ETH within the same address for on-chain transaction Gas fees. This indicates that, at least on the funding path currently publicly sorted, the attacker has concentrated a substantial amount of chips into an asset form pegged to the US dollar, rather than being dispersed among various highly volatile tokens.
From previously public attack cases, quickly converting large illicit gains into US dollar-pegged tokens can be motivated by several considerations: on one hand, it locks in apparent profits in the short term, avoiding exposure to further market price fluctuations; on the other hand, it facilitates subsequent cross-chain transfer, over-the-counter settlement, or multi-address splitting along established routes, shrinking risk variables into a unified pricing unit before executing complex “escape” plans. However, these are merely generalized understandings of common patterns, and there is insufficient evidence to support their applicability to this attacker.
More importantly, regarding the total scale and complete chip distribution of the damage from the Binance hot wallet attack, current public information is still limited to the on-chain analyses of individual media and engineers, and Binance has not provided systemic disclosures on loss amounts, attack paths, and fund whereabouts. In the absence of authoritative and complete data, the outside world can only view the 175 million USDT as "partially confirmed puzzle pieces," and cannot hastily equate them with the whole picture of the event; any judgments about the attacker’s true gains and the safety of their chips must remain restrained and reserved.
Gas Payment Exposes Weakness: May Leave IP Clues
In the Binance hot wallet attack, one detail raised concerns among many engineers: According to Justin Kalland's observation, despite reserving 2 ETH for on-chain Gas, the attacker-controlled wallet still chose to pay the fees through MetaMask Gas Station. For those familiar with infrastructure, this is not the “cleanest” option—services like Gas Station for paying or coordinating Gas essentially have to accept requests through their own servers, calculate fees, and interact with the chain. In the process, technical logs often generate request times, source network environments, and other information that theoretically could establish some level of correlation with the user's IP or node entry.
Kalland's inference remains at this "theoretical possibility": If the attacker indeed directly used MetaMask Gas Station, then the service provider may have left technical records related to this attack in their logs, potentially providing clues for subsequent identification of their network environment. However, so far, there has been no authoritative institution claiming to possess relevant IP information, nor have we seen these clues officially transferred to law enforcement, and we have no way of knowing if the attackers additionally employed VPNs, onion routing, or other anonymity techniques, which means that "Gas Station exposes IP" can only be viewed as a potential breakthrough at the moment, rather than a confirmed means for solving the case.
On-chain Game Is Not Finished: Next Steps for Hackers and Tracking
From the Pando Rings incident to the Binance hot wallet attack, two sides of the same thread can be observed: on one side, hackers actively adjusted their chip structures and Gas strategies—while the former still made a significant purchase of 7,548 ETH after being linked to 0x303D...3d9F, the latter reserved 2 ETH in advance while also choosing to pay Gas through MetaMask Gas Station. On the other side, these operations continuously accrue utilizable traces on-chain and at the network layer: both addresses have been widely marked and become key subjects of observation, while the transaction paths and tool selections of the Binance attack have primarily been analyzed by external parties through public on-chain monitoring and engineer commentary. Currently, the outside world has not grasped the attackers' exact identity or clear IP locking results, but as on-chain analysis technologies become more commonplace and cross-platform collaboration normalizes, the space for "completely escaping tracking" is objectively narrowing—variables worth ongoing observation in the future will be whether project parties and judicial authorities provide more disclosures, whether these large assets continue to experience unusual transfers, and whether trading platforms and tool service providers will further engage in collaborative investigations to push real-world accountability for on-chain clues.
Join our community to discuss and grow stronger together!
AiCoin Exclusive Hyperliquid Benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin Exclusive Aster Benefits: https://www.asterdex.com/en/referral/9C50e2
On-chain Telegram Community: https://t.me/AiCoinWhaleData
On-chain Community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
