$50M Infini hacker dumps ETH bag months after exploit

Surging ETH prices proved too tempting for the attacker to ignore, and they’re now shuffling their loot to lock in profits.

On July 17, 2025, the wallet tied to the hacker behind the Infini exploit re-emerged with on-chain activity, moving 4,770 ETH (ETH) across two addresses. The transfers, worth about $16 million at current prices, mark the first activity from the attacker since the February breach of the crypto-focused neobank, which resulted in the loss of $49.5 million in USDC (USDC).

PeckShieldAlert spotlighted 3,000 ETH funneled through Tornado Cash, the privacy mixer often used to obscure transaction trails. A second address swapped 1,770 ETH for about $5.9 million in DAI (DAI), marking an outright liquidation of part of their loot.

#PeckShieldAlert #Infini Exploiter has transferred 4,770 $ETH (worth ~$16M) to 2 addresses
The address 0x7142…fa41 has laundered 3K $ETH via #tornadocash
The address 0x762d…F9FB has swapped 1,770 $ETH for ~5.9M $DAI pic.twitter.com/usIdcvYRWM

— PeckShieldAlert (@PeckShieldAlert) July 17, 2025

The exploiter’s timing isn’t random, and the pattern of transfers points to profit-taking, especially as Ethereum posts fresh gains. After the original exploit, the Infini hacker converted the stolen stablecoins into 17,696 ETH at an average price of $2,798.

You might also like: GMX hacker returns stolen funds after bounty negotiation

With ETH now trading above $3,400, the stash has swelled to about $59 million, over $10 million in gains for the hacker. So far, the transfers represent only a small slice of their holdings, hinting that the attacker may be testing exits. The wallet still holds roughly $38 million worth of ETH in balance, leaving plenty of room for more selling.

The latest movements further dampen any recovery hopes for the firm. Following the hack, Infini attempted to negotiate with the hacker with a 20% bounty offer and the promise of no legal action if the funds were returned, but those efforts proved futile.

Laundering through mixers and stablecoin conversions makes tracing nearly impossible, making it likely that the stolen funds may be gone for good.

Investigations revealed that the exploit was possible because a developer who helped set up its smart contract retained admin rights, and that access was later used to drain the platform. The Infini breach ranks among the largest crypto exploits this year, alongside other high-profile cases like the $1.4 million Bybit hack in the same month.

Read more: $2.4B lost in 2025 H1 crypto hacks — exchanges and DeFi hit hardest: report

Source