A wallet linked to the infamous Infini exploit has suddenly come back to life and its timing has turned heads across the crypto market.
After sitting dormant for more than 200 days, the address spent roughly $13.3 million scooping up Ethereum during the latest sell-off, before quickly routing the funds through Tornado Cash, according to on-chain data tracked by blockchain security firms.
A well-timed ETH dip buy
Blockchain analytics platform Lookonchain first flagged the activity, showing that the wallet purchased 6,316 ETH at an average price of around $2,109, right as market fear peaked. Within hours, the wallet consolidated its balance and sent a total of 15,470 ETH, worth about $32.6 million, into Tornado Cash.
The movement was independently confirmed by PeckShield and CertiK, both of which identified the address as being tied to the Infini exploit. The deposits mark a clear return to laundering activity after months of silence.
A pattern that keeps repeating
What’s striking is not just the size of the transaction, but how consistently well-timed the wallet’s moves appear to be.
Historical on-chain data suggests the same entity has repeatedly bought Ethereum near local lows and sold close to market tops:
- February 2025: Exploited Infini, stealing about $49.5 million in USDC, later converting it into 17,696 ETH at roughly $2,798.
- July 2025: Sent 5,000 ETH to Tornado Cash and sold 1,770 ETH at around $3,322.
- August 2025: Sold another 1,771 ETH near $4,202, close to local cycle highs.
- February 2026: Bought 6,316 ETH at $2,109, then funneled the full balance through Tornado Cash.
As Lookonchain dryly put it, the exploiter appears “very good at buying low and selling high,” a pattern that continues to frustrate investigators and victims alike.
A reminder of the Infini exploit
The Infini hack dates back to February 2025, when attackers gained access to administrative privileges, draining nearly $49.5 million from the protocol. The stolen funds were rapidly swapped between stablecoins and Ethereum, then scattered across multiple wallets to obscure their trail.
While Tornado Cash still operates at the smart-contract level, it remains under intense regulatory and law-enforcement scrutiny due to its repeated use in laundering illicit crypto funds.
So far, there is no indication that the ETH sent through Tornado Cash has been frozen or recovered. Investigators continue to monitor the address for further movements, but for now, the episode stands as another example of how sophisticated exploiters can combine on-chain transparency with privacy tools and sharp market timing to stay a step ahead.
