Infini Exploiter Washes $32M in ETH Through Tornado Cash After Buying the Dip
The hacker behind the $50M Infini exploit resurfaced to buy the ETH dip at $2,109 before laundering $32.6M through Tornado Cash.
A wallet connected to the $49.5 million Infini neobank hack resurfaced Monday, executing a high-volume arbitrage play before funneling 15,470 ETH ($32.6 million) into the sanctioned mixer Tornado Cash.
The movement, tracked by on-chain analysts, signals that the perpetrator, suspected to be a rogue developer from the February 2025 exploit, remains active and confident in managing a multi-million dollar stolen book despite tightened regulatory scrutiny on mixers.
The Dip Buy
Before the wash cycle began, the exploiter treated the stolen funds as active trading capital. On-chain data reported by PANews shows the wallet deployed 13.32 million DAI to accumulate 6,316 ETH at an average price of $2,109. This entry point effectively capitalized on Ethereum’s recent volatility, where prices briefly wicked down to $1,826 last week before stabilizing near $2,090.
The exploiter has demonstrated a pattern of strategic trading… often utilizing Tornado Cash for fund obfuscation.
Unlike typical smash-and-grab attackers who dump tokens immediately, this entity has rotated capital between stablecoins and ETH for over a year, timing market swings to compound the value of the initial $49.5 million theft.
The Wash Cycle
Immediately following the accumulation, the wallet consolidated its holdings. A total of 15,470 ETH was routed to Tornado Cash in a rapid sequence of deposits. This effectively obfuscates the on-chain history of nearly 65% of the original stolen principal.
The exploit itself traces back to a breakdown in internal controls at Infini, a Hong Kong-based stablecoin neobank. In February 2025, a former developer reportedly leveraged retained admin keys to drain the protocol’s USDC vault. The incident remains a primary case study for insider risk in DeFi, where cryptographic trust is often negated by poor operational security.
Market Impact
While the transfer to Tornado Cash removes a significant supply overhang from visible order books, the exploiter’s ability to move $32 million largely unimpeded highlights the persistent gap between sanctions policy and smart contract immutability. For the market, the immediate fear of a spot-dump is alleviated, replaced by the reality that the bad debt from the Infini collapse is now permanently laundered.
