Same Whale, Same Hacker: $25.6M Drained Again From a Wallet That Already Lost $24M

Same Whale, Same Hacker: $25.6M Drained Again From a Wallet That Already Lost $24M

A crypto whale just lost $25.6 million from the exact same wallet that was drained for $24.2 million in a phishing attack two years ago — and the funds are already gone.

Onchain analyst Specter flagged the exploit, revealing the attacker converted all stolen assets into Dai (DAI) and Ethereum (ETH) almost immediately after the drain. That conversion is the move hackers make when they want to move fast and avoid freezes on more traceable tokens.

The Wild Part Nobody Is Saying Out Loud

This is the same wallet. The same address. The one that was rinsed for $24.2 million in September 2023.

After that first attack, something unusual happened: the attacker returned roughly 90% of the funds. That kind of return almost never happens in crypto theft. It suggested a possible negotiation, a white-hat angle, or a hacker who got cold feet after the scale of the theft attracted attention.

Something clearly didn't stick. Either the whale didn't upgrade their security posture after the first attack, or they were specifically targeted again by someone who knew exactly what was in that wallet.

The total losses across both incidents now sit at just under $50 million from a single address.

What the Conversion to DAI and ETH Means

The immediate swap into DAI is a laundering signal. DAI is a decentralized stablecoin, meaning there is no central issuer who can freeze it the way Circle can freeze USDC. ETH is liquid, bridgeable, and easy to route through mixers or cross-chain protocols.

This attacker knows exactly what they are doing. The window for recovery narrows by the hour once assets hit that conversion path.

The Uncomfortable Question for Every Crypto Holder

If a whale with tens of millions on a single address did not change their behavior after a $24 million loss, it raises a brutal question about how seriously even large holders treat operational security.

Phishing attacks do not require sophisticated code. They require one click, one signed transaction, one moment of inattention. And they are scaling up, not down.

What to Watch

Onchain trackers will be monitoring where the DAI and ETH flow next. If the funds hit a mixer or a cross-chain bridge in the next 24 to 48 hours, recovery becomes nearly impossible. Watch Specter and ZachXBT for real-time updates.

For everyone else: if you are holding significant assets on a single wallet that has ever been compromised, move them now. Not tomorrow. Now.