A blockchain address identified by on-chain analysts as belonging to the entity that siphoned more than $300 million from Coinbase customers earlier this year has resumed trading activity, purchasing 4,863 ether for about $12.6 million late Monday. The coins were acquired at an average price of roughly $2,581, according to wallet-tracking service Lookonchain. The same address off-loaded roughly 26,700 ether—valued at around $69 million—on 22 May at a similar price point, suggesting the hacker is rotating capital rather than exiting the market. Coinbase has not commented on the fresh movements, and the stolen funds remain unrecovered. The buy-back came amid a flurry of large cryptocurrency transfers. Blockchain monitoring service Whale Alert logged a 7,999-bitcoin withdrawal worth about $863 million from Coinbase to a newly created wallet, as well as transfers of more than 35,000 ether to OKX and nearly 21,000 ether from trading firm Cumberland to Coinbase Institutional. Separately, a dormant “genesis” address holding 900 ether—worth less than $300 in 2015—reawakened to move about $2.3 million in tokens. The spate of whale transactions underscores continued volatility in on-chain liquidity flows as major holders reposition amid a flat spot-market price environment for both bitcoin and ether.