Infini exploiter returns to buy $13M ETH dip, sends funds to Tornado Cash

A wallet linked to the Infini exploit has resurfaced after months of dormancy, spending $13.32 million to buy Ethereum during the recent market dip.

The funds were later routed through the crypto mixing service Tornado Cash, according to on-chain data and multiple blockchain security firms.

Blockchain analytics firm Lookonchain flagged the activity, showing that the exploiter purchased 6,316 ETH at an average price of $2,109 roughly eight hours before the transfers were detected.

Shortly after the purchase, the wallet consolidated its holdings and sent a total of 15,470 ETH, worth about $32.6 million, to Tornado Cash.

The transactions were also identified by PeckShield and CertiK, both of which confirmed that the address, labeled as the Infini exploiter, deposited the full Ethereum (ETH) balance into the privacy protocol. Thus, marking a resumption of laundering activity after more than 200 days of inactivity.

Pattern of buying lows, selling highs

On-chain records suggest the wallet has repeatedly demonstrated precise market timing. According to Lookonchain, the same entity:

• February 2025: Exploited Infini by stealing $49.5 million in USDC, later converting the funds into 17,696 ETH at $2,798.
• July 2025: Sent 5,000 ETH to Tornado Cash and sold 1,770 ETH for $5.88 million at $3,322.
• August 2025: Sold 1,771 ETH at $4,202, near local cycle highs.
• February 2026: Bought 6,316 ETH at $2,109, before transferring the full balance to Tornado Cash.

“He seems very good at buying low and selling high,” Lookonchain noted, pointing to the consistent timing of the exploiter’s trades across multiple market cycles.

Background on the Infini exploit

Infini suffered the exploit in February 2025 after attackers compromised administrative privileges, resulting in a total loss of approximately $49.5 million. The stolen funds were rapidly swapped across stablecoins and ETH before being dispersed through multiple wallets, complicating recovery efforts.

While Tornado Cash remains operational at the smart-contract level, its use has drawn heightened scrutiny from regulators and blockchain investigators due to its frequent role in laundering illicit funds.

As of press time, there has been no indication that the funds sent to Tornado Cash have been frozen or recovered. Investigators continue to monitor the wallet’s activity for further movement.