Wallet Tied to Infini Exploiter Resurfaces to Buy Ether Dip for $13M

Why It Matters

The exploiter’s ability to re‑enter the market highlights ongoing risks of illicit capital influencing crypto price dynamics and underscores challenges in tracing and recovering stolen funds.

Key Takeaways

• Infini‑linked wallet buys $13.3M ETH at $2,109
• Funds immediately routed through Tornado Cash mixer
• Activity follows $2.56B leveraged liquidations
• Attacker still trading stolen $50M, not cashing out
• Infini pursues Hong Kong lawsuit against developers

Pulse Analysis

The $50 million Infini breach, one of the largest DeFi heists, left a trail of swapped stablecoins and dormant wallets. After the initial fallout in August 2025, the attacker’s primary address lay silent for nearly a year, prompting speculation that the stolen assets were being laundered or held in cold storage. The recent on‑chain activity shatters that silence, revealing a decisive $13.3 million Ether purchase as the market slipped, and an immediate transfer to Tornado Cash, a privacy‑preserving mixer notorious for obscuring illicit flows.

The timing aligns with a broader market sell‑off that erased roughly $2.56 billion in leveraged positions, pushing Ether to a nine‑month low of $1,811. Large‑scale buying at such levels can provide temporary price support, yet the anonymity of the funds raises concerns about market manipulation and the potential for rapid sell‑offs once the attacker decides to unwind the position. Analysts from Lookonchain noted the pattern as classic “buy low, sell high,” suggesting the exploiter is positioning for a profitable exit.

Infini’s response has been legal as well as technical, filing a Hong Kong lawsuit against the developer Chen Shanxuan and unnamed collaborators, and issuing an on‑chain injunction. While the court action demonstrates a growing willingness to pursue cross‑jurisdictional remedies, the practical recovery of the $50 million remains uncertain, especially given the use of mixers that break the link between source and destination. The episode underscores the need for stronger on‑chain forensics, tighter smart‑contract governance, and clearer regulatory frameworks to deter future exploits and protect market integrity.