BitMEX co-founder and Maelstrom family office head Arthur Hayes has made a definitive exit from his directional cryptocurrency holdings, sparking a wave of onchain activity that immediately attracted opportunistic scammers.
On Saturday morning, onchain trackers recorded approximately $22 million in digital assets leaving wallets associated with Hayes. The prominent crypto entrepreneur did not hesitate to confirm the massive sell-off to his followers, offering a characteristically blunt assessment of his strategic retreat to the sidelines amid an increasingly volatile global landscape.
Writing on X earlier on Saturday, Hayes announced, “I dumped it all,” noting that Maelstrom’s directional book had successfully taken profits on Ethereum (ETH), ENA, UNI, and what he bluntly described as “other shitcoins.” His rationale for the sudden portfolio liquidation centered on mounting macroeconomic and geopolitical anxieties. “I think we gotta go down to go up,” Hayes explained. “It looks a bit dicey out there in macro and geopolitical land. Going to sit on the sidelines and wait for the all clear signal.”
Following his public declaration, onchain block explorers such as Blockscout recorded the swift outflow of millions of dollars in tokens from his designated addresses. However, the high-profile liquidation quickly drew unwanted attention from malicious actors attempting to exploit the flurry of blockchain transactions.
‘I Dumped It All’
Hayes has long been known for his outspoken commentary on macroeconomic trends and digital asset market dynamics, and his latest portfolio maneuver reflects a growing caution regarding near-term price action. By closing out Maelstrom’s directional book entirely, the former BitMEX chief executive has effectively adopted a defensive posture, trading exposure to major altcoins and decentralized finance tokens for cash or stable equivalents while he awaits clearer signals from traditional financial markets and geopolitical arenas.
The decision to cash out comes at a delicate juncture for the broader digital asset economy. Major cryptocurrencies have faced renewed downward pressure amid shifting macroeconomic sentiment and technical corrections. Ethereum, one of the primary assets held in Maelstrom’s directional book, has been trading near the $2,370 region, reflecting a modest loss of roughly 1% over a single 24-hour window. Other assets mentioned by Hayes, including ENA and UNI, experienced sharper pullbacks, each shedding approximately 5% of their value during the same timeframe.
Meanwhile, the flagship cryptocurrency Bitcoin has found itself hovering near the $80,600 mark following a notable technical milestone. Earlier in the week, Bitcoin recorded its first daily close below its 50-day moving average since August, a development that often prompts algorithmic traders and risk-conscious investors to reevaluate their exposure to risk-on assets.
Hayes’s skepticism toward specific sectors of the altcoin market has been building for weeks. In an interview on October 16, he voiced sharp criticism regarding high fully diluted valuation (FDV) tokens, asserting that such assets “can’t even pump” on major exchanges like Binance anymore, while concurrently offering praise to protocols like Hyperliquid for successfully returning native revenue streams back to their token holders. Despite his long-term bullish thesis on decentralized finance and blockchain technology, Hayes clearly feels that the immediate macroeconomic headwinds warrant a complete clearing of his active directional books.
The Scammers Show Up
The high visibility of Hayes’s multi-million-dollar wallet movements also served as an invitation for opportunistic threat actors. Within minutes of the initial token transfers being broadcast to the network, Hayes’s wallet history began filling up with unauthorized, deceptive transactions that he never initiated.
According to token transfer logs examined via Blockscout, a barrage of 26 fake transactions labeled “ETH” appeared in the address history between 05:58 and 07:32 UTC. None of these incoming transfers contained actual Ether. Instead, the malicious operators utilized a deceptive tactic that has become increasingly prevalent across public blockchains: address poisoning.
The scammers manufactured counterfeit tokens spelling out “ETH” by substituting standard Latin characters with look-alike Cyrillic and Greek letters, further concealing their trickery with invisible Unicode characters. These fake tokens were meticulously structured to mirror the exact numerical amounts of Hayes’s legitimate transactions, such as 1,600 and 3,200 tokens. Furthermore, the destination addresses used by the scammers were carefully generated to share the exact first and last four characters of Hayes’s real counterparties.
For instance, while a genuine transfer of 1,600 ETH from Hayes’s wallet successfully reached an intended destination address beginning with 0x58F3 and ending with Ed8B, the decoy addresses engineered by the scammers started with 0x58f3 and concluded with Ed8b, exploiting case-sensitivity and human visual oversight.
Address poisoning is designed to deceive users who frequently copy and paste wallet addresses directly from their recent transaction history rather than verifying every single character or utilizing address books. By seeding a target’s wallet history with these look-alike entries, scammers hope that the account owner or an automated script will inadvertently copy the malicious address during a subsequent transfer, instantly routing funds straight to the attacker.
The threat posed by address poisoning is severe and has resulted in staggering financial losses across the cryptocurrency ecosystem. Data compiled by Scam Sniffer and cited by Bitcoin.com News revealed that a single unsuspecting victim lost $12.2 million in January after accidentally copying a malicious poison address. Months prior to that incident, another high-net-worth trader suffered a staggering $50 million loss in USDT through the exact same vector.
Hayes was not the sole high-profile target during the week. On-chain records show that an anonymous whale who participated in the 2014 Ethereum Initial Coin Offering initiated a transfer of 1,000 ETH toward the Kraken exchange on October 23. Almost immediately, the sender’s wallet history was populated with zero-value transactions originating from look-alike addresses designed to mimic legitimate counterparties. Fortunately, blockchain forensics indicate that neither Hayes nor the veteran ICO participant fell for the trap, with all genuine transfers successfully reaching their intended destinations without incident.
Why Bail Now
The broader market context underlying Hayes’s decision to liquidate his portfolio underscores the fragile equilibrium currently governing digital asset valuations. Strained macroeconomic indicators, shifting interest rate expectations, and geopolitical uncertainties have combined to create an environment where institutional investors and family offices are increasingly inclined to protect capital rather than chase speculative upside.
While Hayes has frequently championed the long-term structural necessity of decentralized currencies as a hedge against sovereign debt expansion and fiat debasement, his tactical execution demonstrates a willingness to move entirely to the sidelines when short-term momentum falters. By shedding his exposure to Ethereum, ENA, UNI, and other volatile altcoins, Maelstrom has effectively insulated itself from the immediate downside risks currently plaguing the wider crypto market.
As onchain trackers continue to monitor the dormant state of Hayes’s emptied wallets, market participants are left watching to see when the outspoken BitMEX co-founder might deem the macroeconomic climate safe enough to re-enter the arena. For now, Hayes remains comfortably on the sidelines, waiting for the macroeconomic clouds to clear and for the market to complete the corrective cycle he believes is necessary before the next major upward leg can begin.
Bitcoin & Major Altcoins
Bitcoin & Major Altcoins
Bitcoin & Major Altcoins
