Three Things to Know
A suspected Binance hack left one attacker address holding a large Ether stash that no issuer can freeze.
Ether trades below both its 50-day and 200-day averages, and sellers still steer momentum.
Traders are watching support near $1,940 in case the wallet starts selling.
Binance is working through a suspected hack that drained billions from its wallets on Oct 29. Tether and Circle froze most of the stolen stablecoins within hours, but the Ether stayed out of reach.
That leaves a large block of ETH sitting idle in a single address. Ether was already sliding before the breach, so any sale would hit a weak market. Traders now want to know whether the attacker will sell the coins slowly or hold them.
Frozen Stablecoins Leave a $440 Million Ether Pile Untouched
Binance suffered a suspected hack on the evening of Oct 29. The exchange put the total impact near $6.3 billion. Its initial probe traced the breach to a DevOps engineer’s compromised laptop. That access let the attacker use a service container to push unauthorized withdrawals. Binance said it found no sign of a private key leak.
Ethereum itself was not hacked. The attacker used EIP-7702, a feature live since the Pectra upgrade, and exploited weak key handling around it.
Binance pledged to cover all losses from its SAFU fund and company money. Deposits and withdrawals are suspended. “User funds are safe,” co-founder Yi He said.
Roughly $3 billion is now frozen on-chain. Investigator ZachXBT counted more than $2.83 billion, mostly stablecoins locked by Tether and Circle. The attacker moved first on Aave, supplying 60 million USDT and borrowing 19,762 wETH (about $45 million), said Marc Zeller of the Aave Chan Initiative.
The bigger problem sits in one address. It holds 195,460 ETH, worth over $440 million. The coins had not moved by late evening UTC. Ether cannot be frozen. The stash equals just under 3% of a typical day’s trading volume.
Ether fell about 2.6% in under an hour after the news. Traders remember Bybit’s thief in February 2025, who sold stolen ETH in tranches over several days.
Ether Trades Under Both Averages Before Any Hacker Selling
Ethereum (ETH) daily price with the nearest support (green) and resistance (red). Source: TradingView
Ether changed hands near $2,230 on Thursday, little changed over 24 hours. The coin is down about 6% on the week and roughly 17% over the past month.
The drop on Oct 29 did not start a slide. It added another leg to one that was already weeks old.
Moving averages show the same picture. A moving average smooths daily prices into a single line, and traders use it to judge the trend. Ether trades below its 200-day average, the long-term gauge many funds watch. It also sits well under its 50-day average near $2,430.
With price below both lines, each acts as a ceiling. Buyers who tried to lift Ether this month ran into selling before they could reclaim either average. The 200-day line sits just overhead, while the 50-day line is a much longer climb away.
Bulls have not controlled the market for weeks. A tranche dump in the Bybit style would land on a market where sellers already set the pace.
Liquidity still exists, but every block of supply weighs more in a falling market.
Sellers Still Steer Momentum Near Oversold
RSI, a 0 to 100 gauge of momentum, sits near 30 on the daily chart. That puts Ether right at the edge of oversold territory. Selling has been heavy enough to stretch the move.
Stretched markets often bounce as short sellers take profits. An oversold reading alone does not show that buyers have returned.
Other momentum gauges agree with that caution. The MACD, which tracks whether recent momentum is speeding up or fading, remains below its signal line. In plain terms, momentum is still pointing down. Trend strength readings show sellers leading a real trend.
That leaves little cushion if the hacker starts selling. An oversold market can stay oversold for days. Fresh supply from one wallet could push the reading deeper.
The Floor a Tranche Sale Would Test
On the daily chart, the first ceiling sits near $2,320, where the 200-day average runs. A close back above that line would show buyers can absorb the hack headlines.
Clearing it would bring the next cap into view around $2,400. A move through that level would open the path back toward the 50-day line.
The downside matters more while the stolen coins sit idle. First support rests at that level, which a tranche sale would likely test. Holding there would suggest the market can take in blocks of supply without breaking.
A drop below it exposes the next floor near $1,850. Losing first support would confirm the selling wave has resumed. Traders would then read every move from the hacker’s address as fresh pressure.
Which Way Ether Breaks if the Wallet Moves
Two paths depend on what the attacker does next.
Bullish: The wallet stays idle and Binance’s updated proof of reserves calms traders. A daily close above the 200-day average would target the next cap overhead. A slide back below first support would cancel this view.
Bearish: Coins start leaving the attacker address in Bybit-style tranches. A break of first support would put the next floor in play. A reclaim of the 200-day line would invalidate the bearish case.
Ether Stays Hostage to One Address
The bias stays bearish. Ether needs to reclaim its 200-day average before buyers can claim control again.
The biggest risk is timing. Nobody knows when, or if, the attacker will sell. Binance’s restart of withdrawals adds another swing factor. Users could pull coins and add pressure, or the reopening could restore confidence and lift the market.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
