The wallet linked to the Mixin Network exploit has moved again after two years of near-total inactivity. According to Lookonchain, the attacker began unloading ETH in small size, first sending 2,005 ETH into Tornado Cash. Three newly created wallets then received a combined 2,087 ETH from the mixer and sold the funds when ETH was trading at about $1,933.
The 2023 Mixin breach drained roughly $200 million in assets
Mixin Network suffered a major security incident on September 23, 2023. The project described itself as a decentralized cross-chain transfer network, but its cloud database was breached, leading to the theft of large amounts of assets from the mainnet. Based on on-chain tracing and the project’s official figures at the time, the attacker stole about $200 million in total, including 59,854 ETH, 891 BTC, and some stablecoins such as USDT.
After the hack, the stolen funds saw little visible movement for an extended period. Attention faded with time. That changed on February 13, 2026, when Lookonchain published fresh tracking data showing that the “Mixin hacker” had likely ended that dormant stretch and started to reduce the ETH position. The amount sold so far is limited, but the remaining balance is large enough that even small transfers are being watched closely.
Funds were routed through Tornado Cash before the sale
Lookonchain said the attacker had still been holding 59,854 ETH and 891 BTC. About 15 hours before the update, the wallet sent 2,005 ETH into Tornado Cash to obscure the source of funds. After that, three fresh wallets received a total of 2,087 ETH from the mixer and quickly sold it. Based on the figures in the report, the attacker still controls around 57,849 ETH, while the full 891 BTC remains untouched.
The transaction pattern points to a measured exit rather than a single large dump. Small transfers, split across wallets, then routed through a mixer before sale. That approach limits market visibility in the short term, but it also raises concern because a much larger stash is still sitting on-chain. For traders and analysts, the key issue is no longer the initial sale size. It is the scale of the remaining ETH and BTC that could move later.
An old exploit is back on the market’s radar
This latest activity was not large enough on its own to disrupt the market, yet it pushed the Mixin case back into focus. The reason is simple: the wallet tied to the exploit still holds assets worth hundreds of millions of dollars. If the attacker continues to sell, that supply could weigh on ETH. The episode also puts attention back on a basic point in crypto security: even projects built around decentralization remain exposed if critical infrastructure, including databases, is not properly protected.