TL;DR
- Lookonchain tracked a wallet tied to the 2023 Mixin exploit sending 2,005 ETH worth $3.85 million to Tornado Cash after two years of dormancy.
- Three new wallets received 2,087 ETH and sold it around $1,933, while ETH traded $1,971 at the time.
- The attacker is linked to 57,849 ETH, 891 BTC and 23.57 million USDT, and the renewed unwind adds selling pressure to a softer Ethereum tape.
Lookonchain flagged a dormant wallet tied to the 2023 Mixin network hack coming back to life, with funds starting to move after roughly two years of inactivity. A long-silent exploiter has restarted on-chain activity, putting fresh sell flow on traders’ radar. Within about 15 hours, the address sent 2,005 ETH, valued near $3.85 million, into Tornado Cash, and the same trail suggested broader selling of 59,854 ETH, or about $117 million. The shift tightened risk controls.
Note that #MixinHacker, who previously stole $200M, appears to be selling 59,854 $ETH($117M) after 2 years of inactivity!
15 hours ago, he sent 2,005 $ETH($3.85M) to #TornadoCash.
Soon after, 3 new wallets received 2,087 $ETH ($4.03M) from #TornadoCash and sold it at $1,933.… pic.twitter.com/8ujC2Berfz
— Lookonchain (@lookonchain) February 13, 2026
How the funds moved and why it matters
The unwind was not a single hop. The movement pattern points to a deliberate liquidation playbook rather than a random transfer. After Tornado Cash, three newly created wallets received 2,087 ETH, roughly $4.03 million, and those coins were sold at about $1,933 each. At the time, Ethereum was changing hands around $1,971.30, implying a discount that converts questionable inventory into immediate liquidity. For market makers, that discount matters because it can ripple across order books quickly.
Mixin’s 2023 breach set the backdrop for today’s flows. The theft scale explains why even partial selling can feel outsized in a risk-off tape. The exploiter is linked to 57,849 ETH worth about $113.4 million, plus 891 BTC worth $59.7 million, and 23.57 million USDT that was converted into DAI. A diversified haul like that supports flexible exit routes and timing. In practice, dormancy often functions as a cooling-off period to reduce scrutiny before reactivating later.
The timing also intersects with broader positioning. As sentiment turns defensive, legacy hack supply becomes a headline-level catalyst. The report said Ethereum’s mood has shifted more negative over the past 24 hours, adding sensitivity to incremental supply. It also cited institutional signaling, including BlackRock moving millions in Ether to Coinbase, which traders often read as potential distribution. Even when that interpretation is debated, it typically raises hedge ratios and widens internal risk buffers across derivatives books.
Not every flow is bearish. Offsetting bids exist, but the market still has to clear any mixer-driven overhang. The piece pointed to Bitmine cushioning pressure through treasury purchases and staking, while ETH traded around $1,970 and was down 1.3% in 24 hours, according to CoinMarketCap. From an operational standpoint, teams will monitor Tornado Cash outflows, subsequent wallet splits, and exchange sales for follow-through. That telemetry will shape near-term liquidity planning and inform escalations to compliance teams.
