Key Highlights
- A wallet linked to the $50 million Infini exploit purchased $13.3 million worth of Ether (ETH) at a price of $2,109.
- Immediately after the purchase, the exploiter routed the funds through Tornado Cash to obscure the transaction trail.
- This is the wallet’s first activity since August 2025; the attacker is known for “expert” timing, previously selling ETH near its yearly high of $4,202.
One of the most notorious “rogue developer” attackers of 2025 has resurfaced, not to return stolen funds, but to play the market.
Blockchain data reveals that the individual behind the $50 million Infini exploit reactivated their wallet last week, capitalizing on a massive market downturn to increase their holdings before funneling the proceeds through a crypto mixer.
Expert timing amid market chaos
As the crypto market endured its 10th-largest liquidation event on record—wiping out $2.56 billion in leveraged positions—the Infini exploiter saw an opportunity. According to Arkham Intelligence, the hacker-labeled address purchased $13.3 million in Ether (ETH) as the price hit a support level of $2,109.
Blockchain tracking firm Lookonchain noted the exploiter’s uncanny ability to time the market, labeling the individual as “very good at buying low and selling high.” This isn’t the first time the attacker has displayed professional-grade trading chops; in August 2025, the same wallet sold $7.4 million in ETH at $4,202, nearly the exact yearly peak.
The laundering pipeline
Shortly after the acquisition, the exploiter moved the funds into Tornado Cash, a non-custodial privacy protocol. This move suggests a calculated effort to “clean” the profits generated from the original $50 million heist.
The Infini exploit, which occurred a year ago, was unique because the attacker immediately swapped stolen USDC for DAI stablecoins. Unlike USDC, DAI lacks a centralized “freeze” function, allowing the attacker to maintain total control over the capital despite international law enforcement efforts.
This incident underscores a major headache for global regulators: the inability to freeze decentralized stablecoins. While Circle (USDC) and Tether (USDT) can blacklist wallets, the use of DAI and Tornado Cash allows the Infini exploiter to operate as a “shadow” hedge fund using stolen capital.
The attacker isn’t just sitting on stolen funds; they are actively growing the “war chest” by trading against retail liquidations. This increases the total liability for the project and makes full recovery for victims less likely over time.
Ongoing legal battle in Hong Kong
The resurgence of on-chain activity comes as Infini continues its legal pursuit of Chen Shanxuan, a developer suspected of being the “rogue” actor who retained administrative privileges post-delivery.
Infini has taken the unconventional step of serving legal notices—including a Hong Kong court injunction—directly to the attacker’s wallet via on-chain messaging. Despite an offer of a 20% white-hat bounty and claims that IP and device data have been gathered, the exploiter remains at large and actively trading.
The Hong Kong lawsuit is a landmark case for legal technology. If the court successfully uses on-chain summons to eventually seize assets or compel a centralized exchange to intervene, it could provide a blueprint for how future DeFi exploits are litigated across borders.
Also Read: South Korea’s FSS Launches Strict 2026 Crypto Oversight and AI Plan
