{"id":21612,"date":"2026-02-09T12:07:36","date_gmt":"2026-02-09T12:07:36","guid":{"rendered":"https:\/\/bitunikey.com\/news\/infini-exploiter-returns-to-buy-13m-eth-dip-sends-funds-to-tornado-cash\/"},"modified":"2026-02-09T12:07:50","modified_gmt":"2026-02-09T12:07:50","slug":"infini-exploiter-returns-to-buy-13m-eth-dip-sends-funds-to-tornado-cash","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/infini-exploiter-returns-to-buy-13m-eth-dip-sends-funds-to-tornado-cash\/","title":{"rendered":"Infini exploiter returns to buy $13M ETH dip, sends funds to Tornado Cash"},"content":{"rendered":"<p><\/p>\n<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">A wallet linked to the Infini exploit has resurfaced after months of dormancy, spending $13.32 million to buy Ethereum during the recent market dip. <\/p>\n<div id=\"cn-block-summary-block_d4c6ade6a5edb3d95912e5eef928450d\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>A wallet linked to the Infini exploit purchased 6,316 ETH worth $13.3 million during the recent price dip before sending funds to Tornado Cash, on-chain data shows.<\/li>\n<li>The address had been inactive for more than 200 days, according to alerts from Lookonchain, PeckShield, and CertiK.<\/li>\n<li>Past transactions suggest the exploiter has repeatedly bought ETH near local lows and sold near cycle highs, highlighting precise market timing.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>The funds were later routed through the crypto mixing service Tornado Cash, according to on-chain data and multiple blockchain security firms.<\/p>\n<p>Blockchain analytics firm Lookonchain flagged the activity, showing that the exploiter purchased 6,316 ETH at an average price of $2,109 roughly eight hours before the transfers were detected. <\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Infini Exploiter bought the dip 8 hours ago, spending 13.32M <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24DAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">$DAI<\/a> to buy 6,316 <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">$ETH<\/a> at $2,109.<\/p>\n<p>He then sent all 15,470 ETH ($32.6M) to <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/hashtag\/TornadoCash?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">#TornadoCash<\/a>.<\/p>\n<p>He seems very good at buying low and selling high:<\/p>\n<p>\ud83d\udc49 Feb 24, 2025: Stole 49.5M <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24USDC&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">$USDC<\/a> and bought 17,696 <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">$ETH<\/a> at $2,798.<\/p>\n<p>\ud83d\udc49 Jul\u2026 <a rel=\"nofollow\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/t.co\/hgLV9sWvQd\">pic.twitter.com\/hgLV9sWvQd<\/a><\/p>\n<p>\u2014 Lookonchain (@lookonchain) <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/lookonchain\/status\/2020676880278626639?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">February 9, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Shortly after the purchase, the wallet consolidated its holdings and sent a total of 15,470 ETH, worth about $32.6 million, to Tornado Cash.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<p>The transactions were also identified by <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/PeckShieldAlert\/status\/2020682937646412138\" target=\"_blank\" rel=\"nofollow\">PeckShield<\/a> and <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/CertiKAlert\/status\/2020687664148828618\" target=\"_blank\" rel=\"nofollow\">CertiK<\/a>, both of which confirmed that the address, labeled as the Infini exploiter, deposited the full Ethereum (ETH) balance into the privacy protocol. Thus, marking a resumption of laundering activity after more than 200 days of inactivity.<\/p>\n<h2 class=\"wp-block-heading\">Pattern of buying lows, selling highs<\/h2>\n<p>On-chain records suggest the wallet has repeatedly demonstrated precise market timing. According to Lookonchain, the same entity:<\/p>\n<ul class=\"wp-block-list\">\n<li>February 2025: Exploited Infini by stealing $49.5 million in USDC, later converting the funds into 17,696 ETH at $2,798.<\/li>\n<li>July 2025: Sent 5,000 ETH to Tornado Cash and sold 1,770 ETH for $5.88 million at $3,322.<\/li>\n<li>August 2025: Sold 1,771 ETH at $4,202, near local cycle highs.<\/li>\n<li>February 2026: Bought 6,316 ETH at $2,109, before transferring the full balance to Tornado Cash.<\/li>\n<\/ul>\n<p>\u201cHe seems very good at buying low and selling high,\u201d Lookonchain noted, pointing to the consistent timing of the exploiter\u2019s trades across multiple market cycles.<\/p>\n<h3 class=\"wp-block-heading\">Background on the Infini exploit<\/h3>\n<p>Infini suffered the exploit in February 2025 after attackers compromised administrative privileges, resulting in a total loss of approximately $49.5 million. The stolen funds were rapidly swapped across stablecoins and ETH before being dispersed through multiple wallets, complicating recovery efforts.<\/p>\n<p>While Tornado Cash remains operational at the smart-contract level, its use has drawn heightened scrutiny from regulators and blockchain investigators due to its frequent role in laundering illicit funds.<\/p>\n<p>As of press time, there has been no indication that the funds sent to Tornado Cash have been frozen or recovered. Investigators continue to monitor the wallet\u2019s activity for further movement.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A wallet linked to the Infini exploit has resurfaced after months of dormancy, spending $13.32 million to buy Ethereum during the recent market dip. Summary A wallet linked to the&hellip;<\/p>\n","protected":false},"author":1,"featured_media":21613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-21612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/21612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=21612"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/21612\/revisions"}],"predecessor-version":[{"id":21614,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/21612\/revisions\/21614"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/21613"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=21612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=21612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=21612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}