Arthur Hayes says he has closed Maelstrom’s entire directional book, and onchain trackers counted about $22 million in tokens leaving his wallets on Saturday morning.
Key Takeaways
- Trackers have identifed $22.28M in Hayes token sales, led by 6,400 ETH worth about $15.2 million.
- Wintermute sent Hayes $2.43M in USDC, likely proceeds from UNI and ZAMA sales, per Onchain Lens.
- Blockscout logged 26 fake “ETH” transfers in his wallet history within 90 minutes of the first sale.
‘I Dumped It All’
Hayes, the BitMEX co-founder who runs family office Maelstrom, did not bother with nuance. “I dumped it all,” he posted on X earlier on Saturday, saying Maelstrom’s directional book took profits on ETH, ENA, UNI, “and other shitcoins.” His reasoning was just as blunt, noting:
I think we gotta go down to go up. It looks a bit dicey out there in macro and geopolitical land.” Going to sit on the sidelines and wait for the all clear signal.
Here is how the morning unfolded, based on onchain trackers and Blockscout records:
- Hayes’s wallet sends 1,600 ETH to a fresh deposit address, which forwarded the coins to a Binance hot wallet two minutes later.
- Another 3,200 ETH leaves the same wallet.
- A final 1,600 ETH goes out, bringing the total to 6,400 ETH.
- Lookonchain flags the dump: 6,400 ETH ($15.2 million), 14 million ENA ($2.76 million), 323,000 UNI ($2.24 million), 1.89 million ETHFI ($1.23 million), plus smaller amounts of AERO, PENDLE and ZAMA.
- Onchain Lens maps the routes, with ENA heading to Binance, UNI and ZAMA to market maker Wintermute, and ETHFI to FalconX. It also spots Wintermute sending Hayes 2.426 million USDC.
- Hayes confirms the offload himself.
The Scammers Show Up
Within minutes, Hayes’s wallet history began filling with transfers he never made as Blockscout’s token transfer log showed 26 transfers of tokens labeled “ETH” between 05:58 and 07:32 UTC, with none of them being real ether.
The fake tokens spelled “ETH” with look-alike Cyrillic and Greek letters padded with invisible characters, and they mirrored his real amounts of 1,600 and 3,200 exactly. The destination addresses also shared the first and last four characters of his real counterparties. His genuine 1,600 ETH went to an address starting 0x58F3 and ending Ed8B while the decoys started with 0x58f3 and ended with Ed8b.
This process is now widely referred to as “address poisoning.” Scammers seed a wallet’s history with look-alike entries and hope the owner copies the wrong address on the next transfer.
Scam Sniffer data cited by Bitcoin.com News showed one victim lost $12.2 million in January after copying a malicious address. Months earlier, a trader lost $50 million in USDT the same way.
Hayes is not the only target this week, as a 2014 Ethereum ICO buyer who moved 1,000 ETH toward Kraken on Oct. 23 received zero-value transfers from look-alike addresses within an hour. Nothing suggests either whale took the bait, with every real transfer going to the intended address.
Why Bail Now
The selling comes amidst a strained macro backdrop as ether is currently trading near $2,370, down about 1% on the day, while ENA and UNI each have fallen roughly 5%. Bitcoin’s price has been hovering near $80,600 after its first daily close below the 50-day moving average since August.
Hayes has been souring on parts of the altcoin market for a while, and in an Oct. 16 interview, he said high fully diluted valuation (FDV) tokens “can’t even pump” on Binance anymore, and praised Hyperliquid for returning revenue to holders.