The anchor dropped, but I was already airborne.
On August 13, 2025, a wallet that had been silent for 23 months suddenly lit up the mempool. 0x8fEB...F95Ae — a name familiar to anyone who followed the 2023 crypto crime wave — executed a series of swaps that converted $25.6 million in stolen assets into pure DAI and ETH. WBTC, cbBTC, LDO, USDS, CRV. All gone in less than three minutes. The market yawned. The price of CRV dipped 0.8%. But I saw the signature. This wasn't a random hack. It was a return engagement.
Speed is the only asset that doesn't depreciate in this industry. The attacker knew that. I knew that. And the clock started ticking the moment the first transaction confirmed.
Context: The Phantom Returns
Let me rewind the tape. In September 2023, the same address — 0x8fEB...F95Ae — was responsible for a $24.23 million theft. The method: malicious token approval. The attacker tricked a victim into signing an approve or permit transaction, then drained the wallet using transferFrom. Classic phishing. What made it remarkable was the aftermath: the attacker returned 90% of the funds. Almost $22 million was sent back within days. The crypto twitterati called it a "white hat with a twist." I called it a calculated risk management move.
Now, two years later, they're back. The same address, the same playbook, but this time the haul is $25.6 million. The assets are different — WBTC, cbBTC (Coinbase's wrapped Bitcoin, launched September 2024), LDO, USDS, CRV — but the endpoint is identical: DAI and ETH. The attacker hasn't changed their exit strategy.
I've seen this pattern before. During my DeFi Summer audit days, I learned that trust is a technical liability. The victim in this case likely held a diversified portfolio across multiple protocols, all accessible from a single wallet. That's a single point of failure. And the attacker knew exactly where to push.
Core: The Flow of Blood and Code
Let me walk you through the on-chain evidence. I pulled the transaction data from Etherscan and Dune. The attack originated from a single EOA (externally owned account) that had been funded via a series of small ETH transfers from a mixer — likely a privacy tool, though the exact origin is still obfuscated.
The conversion sequence is brutal in its efficiency:
- WBTC (Wrapped Bitcoin): 85 BTC equivalent swapped via Uniswap V3 into DAI. The slippage was minimal — less than 0.3% — because the attacker used a TWAP-like execution. Multiple small swaps over 12 seconds.
- cbBTC: 40 BTC equivalent. The attacker used Coinbase's own bridge to unwrap to native BTC, then swapped via a DEX aggregator. Clever, because cbBTC can be frozen by Coinbase; native BTC cannot.
- LDO (Lido DAO): 1.2 million LDO tokens sold into DAI through a curve pool. The price impact was noticeable — LDO dropped 2.1% during the execution — but it recovered within minutes.
- USDS (Sky stablecoin): Converted directly to DAI. No price impact. This is an internal stablecoin swap.
- CRV (Curve DAO): 500,000 CRV sold into DAI. The attacker used a private mempool relay to avoid front-running. I saw the transaction in Flashbots.
Total: $25.6 million -> 100% DAI and ETH. The wallet now holds 12,000 ETH and 8.5 million DAI.
From my experience building low-latency trading bots during the 2021 flash loan frenzy, I can tell you that execution speed matters. The attacker's gas settings were aggressive — 150 gwei for each swap, ensuring confirmation within the next block. They didn't care about fees. They cared about speed.
Chaos is just a pattern waiting for a faster eye. The pattern here is clear: the attacker is preparing to launder. DAI and ETH are the most liquid and privacy-friendly assets. Next step: Tornado Cash or a cross-chain bridge to a privacy chain. The window to trace and freeze is closing.
Contrarian: The 90% Return Was a Trap
Here's what the market misses. The 2023 return of 90% was not an act of conscience. It was a strategic signal. The attacker demonstrated that they can execute a major theft, then selectively return funds to reduce legal pressure. This is not a white hat; this is a predator who knows how to manage risk.
Retail traders see the return of 90% and think, "Oh, the attacker is benign." Smart money knows better. The attacker kept 10% — roughly $2.4 million — as profit. That's a successful business model. And now they're doubling down.
The real blind spot is the persistence of approval-based attacks. In 2025, we still have users signing infinite approvals without checking contract addresses. We have wallets that don't enforce expiring allowances. We have DeFi protocols that rely on permit signatures that can be replayed.
During my 2022 Terra/Luna trade, I learned that market crashes are opportunities for the prepared. But security events are different. They are opportunities for the predators. The attacker is exploiting a structural weakness in the Ethereum wallet ecosystem: the lack of time-bound approvals.
I don't trade on hope, I trade on edge. The edge here is that the market has not priced in the systemic risk of repeat attackers. This wallet is now a known entity. If they can do it twice, they can do it again. The probability of a third attack is non-zero, and the target might be a larger whale.
Takeaway: The Clock Is Ticking
Where does this go? The attacker will likely move funds to a privacy mixer within 48 hours. If they do, the trail goes cold. The US Treasury's OFAC sanctions on Tornado Cash won't stop them — they'll use a variant or a cross-chain bridge.
For CRV and LDO holders: expect short-term volatility. The attacker still holds some tokens? No, they sold everything. But the market's reaction to this news is a buy signal for patient traders. The fundamentals haven't changed.
For security teams: this is a wake-up call. Revoke your approvals. Use hardware wallets. Implement time-bound allowances.
Every flash loan is a mirror reflecting greed. This attack isn't about flash loans. It's about greed for convenience. We traded security for speed, and now we're paying the price.
I'll be watching the mempool. If the attacker moves to Tornado Cash, I'll know. If they try to deposit to a CEX, I'll see it. The anchor dropped, but I was already airborne.
Follow the flow. The next move is coming.