$3.85 Million in Ethereum From Mixin Network Hack Sent to Tornado Cash

In brief

A hacker wallet dormant since 2023 moved $3.85M in Ethereum from the Mixin exploit to Tornado Cash on Thursday.
The Mixin exploit, which took place in September 2023, drained roughly $200M across multiple blockchains.
Mixin plans a full repayment of $23M in MDTu tokens by September 2026.

A wallet linked to the 2023 Mixin hack, which resulted in the loss of $200 million, has moved $3.85 million into a new wallet that then immediately sent the funds to coin mixer Tornado Cash.

The first transaction in two years took place late Thursday night, as the Mixin Hacker wallet—which has been tagged by blockchain analytics platform Arkham Intelligence—moved $3.85 million worth of Ethereum to an unknown wallet 0x9c. That wallet then immediately sent all of the funds to Tornado Cash in 20 separate transactions.

The Mixin exploit dates back to September 2023, when Hong Kong-based crypto platform Mixin Network suspended deposits and withdrawals after hackers drained roughly $200 million from its cloud service provider’s database.

The breach affected assets across multiple chains, making it one of the larger cross-chain infrastructure hacks of the year. Mixin later said it would compensate users up to 50% of their losses in stablecoins, with the remainder issued as tokenized claims.

The Mixin team said on X at the time that it had contacted Google and blockchain security firm SlowMist to help with the investigation.

The attacker-controlled wallet had remained largely dormant for nearly two years before moving $3.8 million on February 12, 2026.

In October 2025, the Mixin Network provided an update on its repayment of users who were impacted by the exploit.

“Following the incident, Mixin Network initiated a debt registration and repayment process, and issued the Mixin Debt Token (MDT) series, including MDTu, MDTb, and MDTe, each representing claims for different categories of affected assets,” the team wrote in its blog post.

The team said it intends to fully repay debt represented by MDTu, worth approximately $23 million, but September 23, 2026, but that there’s currently no repayment schedule for MDTb and MDTe.

Mixin did not shut down after the exploit. It still claims to have more than $1 billion worth of assets under management and more than 1 million customers. The team manages a crypto wallet, custody services, and trading infrastructure.