Headline: Dormant Mixin Hack Wallet Moves $3.85M in Ether to Tornado Cash After Nearly Two Years
A wallet tied to the notorious September 2023 Mixin Network exploit has moved $3.85 million worth of Ethereum into a new address—and that new address immediately pushed the funds into coin mixer Tornado Cash.
Blockchain analytics firm Arkham Intelligence has tagged the original attacker-controlled address as the “Mixin Hacker” wallet. Late on Feb. 12, 2026, that wallet sent 3.85 million dollars in ETH to an unknown address beginning with 0x9c. The 0x9c wallet then split and routed the full amount to Tornado Cash across 20 separate transactions.
Background
The transaction traces back to one of last year’s largest cross-chain infrastructure breaches. In September 2023, Hong Kong-based Mixin Network suspended deposits and withdrawals after attackers drained roughly $200 million from its cloud service provider’s database. The theft impacted assets across multiple chains and forced the platform to halt operations temporarily.
Mixin’s response and repayment plan
Following the hack, Mixin announced a mixed compensation approach: up to 50% of losses would be reimbursed in stablecoins, while the remainder would be issued as tokenized claims. In October 2025 the team updated users on a debt-registration and repayment program, issuing the Mixin Debt Token (MDT) series—MDTu, MDTb, and MDTe—to represent claims across affected asset categories.
Mixin said it intends to fully repay the debt represented by MDTu (roughly $23 million) by Sept. 23, 2026. However, there is currently no repayment timetable for MDTb and MDTe. At the time of the breach, the team also said it had engaged Google and security firm SlowMist to assist with the investigation.
Why this matters
Sending the funds to Tornado Cash—an on-chain mixer commonly used to obfuscate transaction trails—raises red flags for investigators and could complicate recovery efforts. The attacker-controlled address had been largely dormant for nearly two years before the Feb. 12 movement, making this a notable resumption of activity that may indicate an attempt to cash out or re-route stolen assets.
Mixin today
Despite the exploit, Mixin did not shut down. The project still reports over $1 billion in assets under management and more than 1 million users, operating wallet, custody, and trading infrastructure.
The movement will likely draw fresh attention from blockchain sleuths and enforcement agencies tracking funds from the 2023 breach.
Read more AI-generated news on: undefined/news
