Crypto Hacker Behind Infini Exploit Returns, Moves $32M ETH in Fresh Transfers

TheNewsCryptoPublished on 2026-02-09Last updated on 2026-02-09

Abstract

A cryptocurrency wallet linked to the 2025 Infini exploit has resumed activity after 200 days, moving $32 million worth of Ethereum. According to Lookonchain, the wallet purchased 6,316 ETH at an average price of $2,109 during the recent market dip and immediately transferred the entire amount to the privacy service Tornado Cash. This activity, confirmed by security firms PeckShield and CertiK, follows a pattern of the entity accumulating ETH near market lows and moving funds through mixers to obscure tracing. The wallet was originally funded from the Infini hack, which lost $49.5 million in digital assets. Recovery remains difficult once funds enter mixing services like Tornado Cash.

A cryptocurrency wallet, which was linked to last year’s Infini exploit, has been active again after six months of silence. Blockchain trading firm says that the wallet bought millions of dollars’ worth of Ethereum during the recent price drop and then sent it to the private mixing service, which is supposed to hide where the money goes.

According to the data shared by Lookonchain, the wallet bought 6,316 ETH and paid an average price of roughly $2,109 per coin. Immediately, the entire balance was moved to Tornado Cash, and this movement was confirmed by the two security companies, PeckShield and CertiK. Researchers noted that this address showed activity after 200 days.

What is Tornado Cash

Basically, Tornado Cash is a cash mixer. It works by mixing many users’ cryptocurrencies before redistributing them, which makes it very difficult to trace the source. This helps protect the user’s money from hacking and exploits and avoids being tracked by exchanges or enforcement agencies.

The analyst says that this wallet has shown an unusual pattern of trading, accumulating ETH at the near local market lows and selling the portion near strong highs. The past activity includes, after the Infini attack, the stolen funds being turned into 17,696 ETH in February 2025. In July 2025, 5000 ETH was sent to Tornado Cash. In February 2026, 6,316 ETH were bought at the recent dip at $2,109.

Infini suffered its major security failure in Feb 2025. At that time, attackers gained control over the internal permissions, which allowed them to move about $49.5 million in digital assets. The funds were quickly swapped across tokens and converted into ETH. This was distributed across many wallets. This strategy complicated the recovery attempts.

Right now, there is no sign that the newly moved ETH has been frozen, and the investigators are still watching for where the money might surface next. Once assets pass through mixers, the recovery usually becomes much harder.

Highlighted Crypto News:

Coinglass Report Highlights Discrepancies Across Perp DEXs, Raising Debate

TagsCryptocurrencyETH

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
comp
CompoundCOMP
mantra
MantraMANTRA
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
velodrome
Velodrome FinanceVELODROME
brev
BrevisBREV
zrx
ZRX（0X）ZRX
cake
PancakeSwapCAKE

Related Questions

QWhat was the recent activity of the cryptocurrency wallet linked to the Infini exploit?

AThe wallet, after six months of inactivity, bought 6,316 ETH at an average price of $2,109 and immediately sent the entire amount to the Tornado Cash mixing service.

QWhat is the primary function of Tornado Cash as described in the article?

ATornado Cash is a cryptocurrency mixing service that obfuscates the trail of funds by pooling and mixing them with those of other users, making it extremely difficult to trace their origin.

QHow much Ethereum (ETH) was converted from the stolen funds after the Infini attack in February 2025?

AThe stolen funds from the Infini attack were converted into 17,696 ETH.

QWhat was the total value of digital assets the attackers moved in the Infini security failure?

AThe attackers moved approximately $49.5 million in digital assets during the Infini exploit.

QWhat trading pattern did analysts observe in the wallet's past activity?

AAnalysts noted an unusual pattern where the wallet accumulated ETH near local market lows and sold portions of it near strong market highs.

Related Reads

Agent Race Ends, Super Workbench Takes Over

The era of fragmented AI agents is ending. Over the past month, China's tech giants—Tencent, Alibaba, and ByteDance—have simultaneously shifted strategy: instead of launching new, standalone AI agents, they are consolidating their various agent projects into unified "super workbenches." Tencent integrated its QClaw teams into WorkBuddy, a strategic product hailed as a potential third flagship after QQ and WeChat. Alibaba is merging its QoderWork, Wukong, and MuleRun agents into a new "Qianwen Office" platform under DingTalk's leadership. ByteDance rebranded its TRAE SOLO coding agent to TRAE Work, signaling a broader focus on workflow collaboration. This convergence marks a pivotal industry consensus. The initial exploration phase, where companies rapidly built numerous overlapping agents for different scenarios, proved costly and inefficient. With open-source tools eroding technical barriers, competition has shifted from agent creation to resource consolidation and cost control. Historically, platform wars are won not by creating more products, but by simplifying them—as seen with browsers unifying web access and super-apps consolidating services. Now, the "super workbench" aims to become the unified AI entry point for work. This reflects a deeper market realization: the primary audience for AI is no longer just programmers (a market in the tens of millions) but all knowledge workers (a market of billions). The real opportunity lies in augmenting everyday tasks—managing emails, documents, data, and meetings—across the entire workday. The core battleground is becoming control over the primary AI entry point that employees use daily. Tencent's WorkBuddy leverages WeChat and Tencent Docs; Alibaba's Qianwen Office taps into DingTalk's organizational data; ByteDance's TRAE Work integrates with Feishu's workflows. Whoever owns this "super workbench" gains strategic control over orchestrating enterprise data and APIs. This shift is redefining enterprise software. Traditional SaaS applications, valued for their user interfaces, will recede into the background. Their core functionalities will be exposed as standardized "Skills" or APIs for the super workbench's agents to invoke. Software value will shift from selling user seats to charging based on API calls and outcomes delivered. The evolution of agents is moving through clear stages: first as novel standalone products, then as consolidated primary work entry points, and finally as pervasive, invisible capabilities embedded into the digital fabric. The recent moves by major tech firms signal the transition from the first stage into the second, accelerating toward the third. In the end, the most successful agent technology may become invisible—like electricity or the HTTP protocol—a fundamental, unnamed infrastructure powering work itself.

marsbit11m ago

Agent Race Ends, Super Workbench Takes Over

marsbit11m ago

Michael Saylor: 110 Reasons to Oppose BIP-110

Michael Saylor presents 110 arguments against Bitcoin Improvement Proposal (BIP) 110, a soft fork aimed at restricting certain non-monetary data storage uses (like inscriptions) on the Bitcoin blockchain. He acknowledges the proponents' valid concerns—such as node costs, fee pressure, and preserving Bitcoin's monetary focus—but fundamentally disagrees with the proposed solution. Saylor argues that BIP 110 represents a dangerous precedent of using consensus rules to enforce value judgments on transaction validity, moving away from Bitcoin's core principles of neutrality and permissionless innovation. His key objections are organized into eleven categories: 1) It violates neutrality and hard consensus by banning currently valid transactions. 2) It fails to meet the high burden of proof required for a consensus change, lacking concrete data on the alleged crisis. 3) Its seven bundled technical restrictions are overly broad, targeting generic script functionalities and blocking future upgrade paths. 4) It sacrifices compatibility and future optionality by closing off designed upgrade hooks. 5) Its temporary rules add significant complexity (grandfathering, expiry states) without sufficient justification. 6) The economic and security impacts, particularly on miner revenue and fee markets, are uncertain and unmodeled. 7) Superior, market-based tools (fee markets, relay/mining policies) already exist to manage blockchain load. 8) It stifles innovation by creating a chilling effect for developers. 9) Its modified activation mechanism (55% threshold, forced signaling) is aggressive and risks network splits. 10) The precedent it sets—using consensus to suppress disliked but legal uses—is more dangerous than the problem it aims to solve. 11) A better path exists: improving measurements, refining resource-based policies, and allowing market forces to work. Saylor concludes that Bitcoin's strength lies in its neutral rules, open markets, and hard consensus. Changing these foundational elements to target specific use cases is an unnecessary and risky "iatrogenic" intervention. He advocates for guarding Bitcoin's neutrality rather than acting as its redeemer.

marsbit27m ago

Michael Saylor: 110 Reasons to Oppose BIP-110

marsbit27m ago

United Stables Crosses $1B As Chainlink Data Feeds Secure U Token Collateral

United Stables' U token has surpassed $1 billion in market capitalization, with Chainlink Data Feeds providing the critical pricing and collateral data infrastructure across its deployment chains. This milestone highlights that robust oracle infrastructure is essential for stablecoin credibility, as DeFi protocols require reliable data for integration. Chainlink's role is foundational, enabling automated collateral auditing and pricing verification, which helps make the U token safer for the broader market to evaluate and use. While this strengthens Chainlink's position in the stablecoin infrastructure narrative, it does not directly guarantee increased fees or value for LINK token holders. The growth of U indicates both widening competition in the stablecoin sector and the increasing dependence of scalable stablecoins on dependable external data services.

bitcoinist1h ago

United Stables Crosses $1B As Chainlink Data Feeds Secure U Token Collateral

bitcoinist1h ago

BonkDAO Treasury Drain Shows Solana Governance Risk Is Real

The BonkDAO treasury suffered an approximately $20 million drain due to a malicious governance proposal passed through the Realms platform on Solana. This incident highlights governance as a critical attack surface for DAOs, distinct from smart contract exploits. The attack leveraged the DAO's own voting mechanics to move funds, demonstrating that flawed governance design—such as weak proposal rules or voter weight calculations—can be exploited even when the underlying blockchain functions correctly. The event serves as a warning for Solana DAOs to rigorously review and strengthen their governance safeguards, including quorum thresholds, timelocks, and execution permissions. While damaging to community trust, especially for the prominent BONK meme ecosystem, the issue is not a failure of the Solana base layer but a widespread application-level risk common across blockchain ecosystems.

bitcoinist2h ago

BonkDAO Treasury Drain Shows Solana Governance Risk Is Real

bitcoinist2h ago

Midnight Token Falls After $13M Wanchain Bridge Exploit

Midnight's NIGHT token plummeted roughly 30% following a $13.2 million exploit on a Wanchain cross-chain bridge. The attacker drained 515 million NIGHT tokens by exploiting a signature reuse flaw in the bridge's infrastructure, not the core Cardano or Midnight networks. This incident highlights the persistent vulnerability of cross-chain bridges, which are critical for asset transfers but introduce complex security risks. While the underlying blockchains remained secure, the token's price suffered due to liquidity disruption and lost market confidence. The response from Wanchain, including pausing the affected bridge and providing clear communication on recovery efforts, will be crucial for stabilizing the situation. The event serves as a reminder for traders to factor in bridge-related risks when evaluating tokens reliant on cross-chain liquidity.

bitcoinist2h ago

Midnight Token Falls After $13M Wanchain Bridge Exploit

bitcoinist2h ago

Trading

Spot

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of ETH (ETH) are presented below.

活动图片

Top Questions