The hacker who drained millions from the Nomad Bridge didn’t just vanish into the dark corners of Tornado Cash. They executed a trade that would make most fund managers jealous. On August 20, 2024, an address linked to the 2022 exploit spent 38.5 million DAI/USDS to buy 18,273 ETH. Nine months earlier, that same address had sold 17,124 ETH at $3,308. Math doesn’t negotiate. The result: a realized profit of 36% in USD terms and a net increase of 1,149 ETH in holdings. This isn’t a random splurge—it’s a calculated high-low strategy embedded in the blockchain’s immutable ledger.
Context
To understand the significance, we need to rewind. The Nomad Bridge hack in August 2022 saw over $190 million stolen due to a smart contract vulnerability. The attacker used a faulty initialization process to drain funds. Most of the stolen assets were later moved through Tornado Cash, a privacy mixer that obfuscates transaction histories. By November 2023, the hacker had stored a portion of the loot in ETH and DAI. On November 18, 2023, they sold 17,124 ETH at an average price of $3,308, netting roughly 56.6 million DAI. Then they waited. For nine months, that stablecoin sat untouched. Then, on August 20, 2024, with ETH trading around $2,109, they bought back 18,273 ETH for 38.5 million DAI. The remaining 18.1 million DAI stayed in the wallet.
This is a textbook case of buy low, sell high. But the use of Tornado Cash complicates the narrative. The funds entered the selling address from a Tornado Cash pool. That means the hacker has already mixed the original stolen ETH, breaking the on-chain link. The subsequent trade, however, is fully visible on Ethereum. The hacker chose to move the stablecoins back into ETH through a series of transactions on decentralized exchanges, likely using a routing algorithm to minimize slippage over five hours.
Core Analysis
Let’s break down the numbers. At the time of the sale in November 2023, ETH was trading near its local peak. The hacker sold at $3,308, securing a high price. Nine months later, after the ETH price had dropped 36%, they repurchased at $2,109. The result: a dollar profit of 18.1 million (56.6M - 38.5M) and an ETH count increase of 1,149 ETH (18,273 - 17,124). In portfolio terms, they now hold more ETH than before, plus a stablecoin reserve. This is not a loss—it’s a successful risk management trade.
From my experience auditing DeFi protocols and tracing stolen funds, I’ve seen two patterns: attackers who panic sell and those who methodically manage their loot. This hacker belongs to the latter category. They understood that ETH’s volatility is a double-edged sword. By converting to stablecoins during a peak, they preserved capital. Then, sensing a bottom or at least a re-entry point, they allocated back into ETH. The 5-hour execution window suggests they used a bot or a DEX aggregator to break the order into smaller chunks, avoiding a single large market impact. The trade represents roughly 0.1% of ETH’s daily volume, insignificant for the market but significant for the hacker’s balance sheet.
The use of Tornado Cash is a critical detail. The hacker received the initial ETH from the mixer, but the sell and buy transactions were on public exchanges. This hybrid approach shows they understand the trade-off between privacy and liquidity. Tornado Cash provides anonymity at the source, but once the funds hit a DEX, they become traceable again. However, because the original source is mixed, the legal link to the hack is weaker. Still, any address that interacts with Tornado Cash is flagged by compliance tools like Chainalysis. The hacker’s new address holding 18,273 ETH is now under surveillance.
Market Impact
This trade had no material effect on ETH’s price. The buy pressure of 38.5 million DAI was absorbed over hours, and the market has since moved on. The psychological impact is more interesting. When on-chain sleuths like Yu Jin (@yujin_733) reported this, the narrative shifted from "hacker on the run" to "hacker trader." Some viewed it as a bullish signal—a sophisticated actor adding to ETH position at a perceived discount. Others saw it as a desperate attempt to recoup losses (though the hacker was already profitable). The truth is more neutral: this is a risk-adjusted move, not a directional bet on ETH’s future.
Contrarian Angle
Here’s where the common narrative breaks down. Most headlines frame this as "hacker spends $38.5M on ETH," implying a loss or a reckless move. In reality, this is a disciplined portfolio rebalancing. The hacker increased their ETH exposure while still holding 18.1 million in stablecoins. That’s a 48% allocation to ETH, 52% to cash. For a fund, that’s conservative. For a hacker, it’s cunning. The real risk isn’t the trade—it’s the regulatory exposure. Tornado Cash is sanctioned by the U.S. Treasury. Any entity that interacts with it risks asset freezes, legal liability, or even criminal charges. The hacker likely knows this. By moving back into ETH, they may be preparing to exit through decentralized venues that don’t enforce sanctions, or they could be planning to hold long-term, hoping for a future where the sanctions are lifted or the funds are untraceable.
Another blind spot: the assumption that the hacker is acting alone. The trade could be executed by a team, perhaps a professional trading firm that acquired the stolen keys. The 9-month gap between the sale and the buy suggests patient capital, not a panicked individual. This is a signal that the stolen funds are being actively managed, not just stored.
Takeaway
This case is a masterclass in on-chain forensics. It shows that attackers are not just thieves—they are traders, portfolio managers, and risk analysts. The hacker’s next move will be telling. If they move the ETH back into a mixer, expect a future sell. If they hold, they are betting on a bull run. Either way, the blockchain will record it. The lesson for the industry: compliance tools must evolve to track not just the flow of stolen funds, but the financial behavior of the actors. Privacy is a feature, but it comes with a cost. Code is law, but bugs are reality. The hacker is using both to their advantage. The question is: will the market and regulators respond in kind?
As for the ETH price, the trade is a minor footnote. But the psychology behind it—the calculated patience, the technical execution, the regulatory risk—is a story that will be studied for years. The next time you see a suspicious address, look beyond the wallet. It might just be a hedge fund in disguise.
