Arthur Hayes dumps Maelstrom's $22 million crypto book, and scammers move in within 90 minutes

Arthur Hayes has gone to cash. The BitMEX co-founder, who now runs the family office Maelstrom, said on X on Saturday, October 24, that he sold the fund's entire directional crypto book, and onchain trackers put the Arthur Hayes Maelstrom sale at about $22.28 million in tokens. The biggest piece was roughly 6,400 ETH. His explanation was short and blunt: "I think we gotta go down to go up."

For a trader best known for big bullish calls, that is a sharp turn. It also landed days before a Federal Reserve meeting, in a market that has already been sliding. Here is what was sold, where it went, why it matters for regular holders, and the scam that showed up in his wallet history within 90 minutes.

What Arthur Hayes sold and where it went

Hayes confirmed the move himself. "I dumped it all," he wrote on X. "The Maelstrom directional book, took profits on $ETH, $ENA, $UNI and other shitcoins." He added that it "looks a bit dicey out there in macro and geopolitical land" and that Maelstrom would sit on the sidelines and "wait for the all clear signal."

Onchain analytics account Lookonchain counted the outflows, and CoinGape and Bitcoin.com News both reported the same tally:

• ETH: about 6,400 ETH, worth roughly $15.2 million
• ENA (Ethena): about 14 million tokens, worth roughly $2.76 million
• UNI (Uniswap): about 323,000 tokens, worth roughly $2.24 million
• ETHFI: about 1.89 million tokens, worth roughly $1.23 million, according to Bitcoin.com News
• Smaller positions: AERO, PENDLE and ZAMA

The routing

According to Bitcoin.com News, the ether left in three transfers of 1,600, 3,200 and 1,600 ETH. The first batch went to a fresh deposit address that forwarded it to a Binance hot wallet about two minutes later. Onchain Lens mapped the rest: ENA went to Binance, UNI and ZAMA went to market maker Wintermute, and ETHFI went to FalconX. Wintermute then sent Hayes about 2.43 million USDC, which Bitcoin.com News said likely came from the UNI and ZAMA sales.

Routing tokens through exchanges and over the counter desks like this is standard for a fund trying to exit size without moving prices too much. It is also why the sale was visible to anyone watching his wallets in real time.

Why the Maelstrom exit matters

Hayes is not just another large holder. His essays and posts move sentiment, and he has a long record of very bullish targets. CoinGape noted that weeks earlier he had floated ETH reaching $10,000, and that he has argued Bitcoin could one day hit $1 million. A full exit from someone with that reputation tells you he sees near term risk as bigger than near term upside.

The timing adds weight. The Fed meets October 27 and 28, with the rate decision due at 2 p.m. Eastern on October 28, according to Startup Fortune, which reported that markets largely expect rates to stay where they are. CoinGape described a week weighed down by hawkish Fed signals, ETF outflows and risk off moves across tech and AI stocks. If you followed our coverage of the $635 million in Bitcoin ETF outflows earlier this week, this fits the same mood.

Prices were soft when he sold. Bitcoin.com News reported ETH near $2,370, down about 1% on the day, with ENA and UNI each off around 5%. Bitcoin hovered near $80,600 after its first daily close below its 50 day moving average since August. That level has been tested before, as we covered when Bitcoin fell to $80,000 ahead of the flash crash anniversary.

A reversal, not a one off

This is not the first sharp turn. Startup Fortune reported that nine days before the sale, Hayes had said publicly that he held long Bitcoin and Ether positions. The same outlet said that in June he sold 6,000 ETH at a $606,000 loss, then started buying ether back above $1,900 from July 15. CoinGape also noted he previously sold his whole Hyperliquid position.

Critics have pushed back on this pattern before. Startup Fortune reported that onchain investigator ZachXBT accused Hayes of using his following as exit liquidity after a quick run of trades earlier this year. Hayes framed this latest sale as risk management. CoinGape presented it the same way, as a short term call rather than a change in his long term view.

The address poisoning attack that followed

The part of this story that matters most for everyday wallet users is what happened next. According to Bitcoin.com News, the block explorer Blockscout logged 26 fake transfers of tokens labeled "ETH" into Hayes's wallet history between 05:58 and 07:32 UTC, within 90 minutes of his first sale. None of them were real ether.

This is called address poisoning, and it works like this:

1. A scammer watches for large, public transfers.
2. They create an address that matches the first and last few characters of an address you actually used.
3. They send a worthless token, or a zero value transfer, from that look alike address so it appears in your history.
4. They hope you later copy the wrong address from your history and send real funds to them.

The decoys aimed at Hayes were careful. Bitcoin.com News said they used look alike Cyrillic and Greek letters padded with invisible characters, matched the exact 1,600 and 3,200 ETH amounts of his real transfers, and mirrored the first and last four characters of his real counterparties. His genuine transfer went to an address starting 0x58F3 and ending Ed8B. The fakes started 0x58f3 and ended Ed8b.

Hayes's real transfers reached their intended addresses, and the outlet said nothing suggests he fell for it. Others have not been so lucky. Citing Scam Sniffer, Bitcoin.com News said one victim lost $12.2 million in January after copying a malicious address, and another trader lost $50 million in USDT the same way. The same report said a 2014 Ethereum ICO buyer who moved 1,000 ETH toward Kraken on October 23 also got look alike transfers within an hour.

What crypto holders should do now

You do not need to copy a famous trader's exit. Hayes runs a fund with its own risk limits and timeline, and he has changed direction several times this year. Still, his move and the scam around it offer a few practical reminders.

Check your exposure before the Fed. Big macro events tend to bring sharp swings. If a 20% drop in your holdings would force you to sell, that is a sign your position may be too large. Our earlier piece on crypto liquidations after a hot CPI print shows how quickly leverage gets wiped out.

Never copy addresses from your transaction history. Use a saved address book, scan a QR code from the recipient, or confirm the full address through a second channel. Check more than the first and last four characters.

Hide or ignore unknown tokens. If a token you never bought shows up in your wallet, do not interact with it. Many wallets let you hide spam tokens.

Test with a small amount. For large transfers, send a small test payment first and confirm it arrived where you expected.

If you are newer to self custody, our guides on how crypto wallets work and how to spot a crypto scam cover the basics.

What to watch next

The first thing to watch is the Fed decision on October 28 and what Jerome Powell says afterward. A dovish tone could ease pressure on risk assets. A hawkish one could push Bitcoin further below $80,000.

The second is whether Hayes re-enters, and when. He has not said what his "all clear signal" looks like. Because his wallets are public, any buyback is likely to show up onchain quickly, and trackers will report it.

The third is altcoin liquidity. ENA and UNI each dropped around 5% on the day he sold. Large holders exiting thinner markets can move prices more than a similar sale in ETH or BTC. For more market news as it develops, see our crypto section.

Frequently asked questions

How much crypto did Arthur Hayes sell?

Onchain trackers counted about $22.28 million in sales from Maelstrom's directional book, led by roughly 6,400 ETH worth about $15.2 million, plus ENA, UNI, ETHFI and smaller altcoins.

Why did Arthur Hayes sell everything?

He said macro and geopolitical conditions look "dicey" and that crypto may need to fall before it rises. He plans to stay on the sidelines until he sees an all clear signal.

Is Arthur Hayes bearish on crypto long term?

He has not said so. Reports framed the sale as short term risk management, and he has made very bullish long term predictions in the past, including for ETH and Bitcoin.

What is address poisoning?

It is a scam where attackers send fake or zero value transfers from look alike addresses, hoping you later copy the wrong address from your history and send real funds to them.