Crypto Hacker Behind Infini Exploit Returns, Moves $32M ETH in Fresh Transfers

TheNewsCryptoPublished on 2026-02-09Last updated on 2026-02-09

Abstract

A cryptocurrency wallet linked to the 2025 Infini exploit has resumed activity after 200 days, moving $32 million worth of Ethereum. According to Lookonchain, the wallet purchased 6,316 ETH at an average price of $2,109 during the recent market dip and immediately transferred the entire amount to the privacy service Tornado Cash. This activity, confirmed by security firms PeckShield and CertiK, follows a pattern of the entity accumulating ETH near market lows and moving funds through mixers to obscure tracing. The wallet was originally funded from the Infini hack, which lost $49.5 million in digital assets. Recovery remains difficult once funds enter mixing services like Tornado Cash.

A cryptocurrency wallet, which was linked to last year’s Infini exploit, has been active again after six months of silence. Blockchain trading firm says that the wallet bought millions of dollars’ worth of Ethereum during the recent price drop and then sent it to the private mixing service, which is supposed to hide where the money goes.

According to the data shared by Lookonchain, the wallet bought 6,316 ETH and paid an average price of roughly $2,109 per coin. Immediately, the entire balance was moved to Tornado Cash, and this movement was confirmed by the two security companies, PeckShield and CertiK. Researchers noted that this address showed activity after 200 days.

What is Tornado Cash

Basically, Tornado Cash is a cash mixer. It works by mixing many users’ cryptocurrencies before redistributing them, which makes it very difficult to trace the source. This helps protect the user’s money from hacking and exploits and avoids being tracked by exchanges or enforcement agencies.

The analyst says that this wallet has shown an unusual pattern of trading, accumulating ETH at the near local market lows and selling the portion near strong highs. The past activity includes, after the Infini attack, the stolen funds being turned into 17,696 ETH in February 2025. In July 2025, 5000 ETH was sent to Tornado Cash. In February 2026, 6,316 ETH were bought at the recent dip at $2,109.

Infini suffered its major security failure in Feb 2025. At that time, attackers gained control over the internal permissions, which allowed them to move about $49.5 million in digital assets. The funds were quickly swapped across tokens and converted into ETH. This was distributed across many wallets. This strategy complicated the recovery attempts.

Right now, there is no sign that the newly moved ETH has been frozen, and the investigators are still watching for where the money might surface next. Once assets pass through mixers, the recovery usually becomes much harder.

Highlighted Crypto News:

Coinglass Report Highlights Discrepancies Across Perp DEXs, Raising Debate

TagsCryptocurrencyETH

Trending Cryptos

Related Questions

QWhat was the recent activity of the cryptocurrency wallet linked to the Infini exploit?

AThe wallet, after six months of inactivity, bought 6,316 ETH at an average price of $2,109 and immediately sent the entire amount to the Tornado Cash mixing service.

QWhat is the primary function of Tornado Cash as described in the article?

ATornado Cash is a cryptocurrency mixing service that obfuscates the trail of funds by pooling and mixing them with those of other users, making it extremely difficult to trace their origin.

QHow much Ethereum (ETH) was converted from the stolen funds after the Infini attack in February 2025?

AThe stolen funds from the Infini attack were converted into 17,696 ETH.

QWhat was the total value of digital assets the attackers moved in the Infini security failure?

AThe attackers moved approximately $49.5 million in digital assets during the Infini exploit.

QWhat trading pattern did analysts observe in the wallet's past activity?

AAnalysts noted an unusual pattern where the wallet accumulated ETH near local market lows and sold portions of it near strong market highs.

Related Reads

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

Coldcard Hardware Wallet Hacked: Losses Mount Due to Vulnerable Seed Generation A critical vulnerability in Coldcard hardware wallets has led to a continued wave of fund thefts. According to Galaxy Research, the total stolen has reached 1,367.05 BTC (approx. $88.6 million) from 4,585 addresses, a significant increase from the initial 594.5 BTC reported on July 30, 2026. Most of the stolen funds remain on the attackers' addresses. The issue is not with the current firmware, which Coinkite has updated, but with seed phrases generated on vulnerable devices between March 2021 and the release of fixed firmware versions. Due to a programmer error, devices switched from using a hardware random number generator to the software-based Yasmarang generator, which was initialized with publicly accessible data like the chip's serial number. This made the seed phrases predictable through offline brute-force attacks, meaning wallets remain at risk until funds are moved to a new wallet generated with the patched firmware. Affected devices include Mk2/Mk3 with firmware 4.0.1–4.1.9 (and up to 5.0.3), Mk4/Mk5 up to version 5.6.0, and Q models up to 1.5.0Q. The only exceptions are seeds created with a high-entropy method like at least 50 independent dice rolls or a strong unique BIP-39 passphrase. All other owners must generate a new seed on the fixed firmware and transfer their assets. A case highlighting the human impact involves a 39-year-old long-term investor who lost 2 BTC (approx. $130,000) in minutes. He had accumulated the Bitcoin over eight years through physical labor, viewing it as a financial lifeline and a retirement plan in a country suffering from hyperinflation. His story underscores that even conservative "buy and hold in cold storage" strategies can be compromised by such underlying technical flaws. From a technical perspective, this incident echoes historical failures where weak random number generators undermined cryptographic security, challenging the assumption that offline storage is automatically foolproof.

cryptonews.ru1h ago

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

cryptonews.ru1h ago

Trading

Spot

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of ETH (ETH) are presented below.

活动图片