A Ethereum wallet associated with multiple high-profile DeFi hacking incidents suddenly resumed activity after approximately 12 months of silence, sparking significant market attention. On-chain data shows that the wallet recently sold off over $2 million worth of various mainstream cryptocurrencies, highlighting the ongoing risks of cryptocurrency theft.
According to on-chain analysis platform Lookonchain, on December 30th, this Ethereum address sold large amounts of tokens including UNI, LINK, CRV, and YFI in a single transaction. The sale included approximately 226,961 UNI tokens worth about $1.36 million; 33,215 LINK tokens valued at nearly $410,000; 845,806 CRV tokens worth around $328,000; and more than 5 YFI tokens valued at approximately $17,500. Additionally, the address also liquidated or reduced holdings of other tokens.
On-chain tracking indicates that this wallet is closely linked to the 2021 Indexed Finance hack and the 2023 KyberSwap attack. Indexed Finance was attacked that year due to flash loan and price manipulation vulnerabilities, resulting in losses of about $16.5 million. The attacker claimed their actions complied with smart contract rules, sparking widespread controversy over DeFi mechanism design.
Later, in November 2023, the Elastic liquidity pool of KyberSwap was repeatedly exploited across multiple blockchains, draining nearly $49 million. Following the attack, the hacker even attempted to extort the protocol team by offering to return some assets, further shaking the market.
In February 2025, U.S. law enforcement released indictment documents accusing 22-year-old Canadian suspect Medjedovic of carrying out the two aforementioned attacks. Prosecutors stated that he laundered the stolen assets through mixers and cross-chain bridges, and pressured the KyberSwap team after the attacks. The suspect remains at large.
The reactivation of this wallet also reflects the severe risks of cryptocurrency theft in 2025. According to Chainalysis data, the estimated losses from crypto asset theft in 2025 range between $2.7 billion and $3.4 billion. Over 60% of these losses are related to centralized platforms, and many incidents are believed to be connected to North Korean hacking organizations. Although the average loss per individual wallet has decreased, the overall security situation remains grim.
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
After a year of silence, suddenly selling off $2 million worth of crypto assets, DeFi hacker linked wallet appears again
A Ethereum wallet associated with multiple high-profile DeFi hacking incidents suddenly resumed activity after approximately 12 months of silence, sparking significant market attention. On-chain data shows that the wallet recently sold off over $2 million worth of various mainstream cryptocurrencies, highlighting the ongoing risks of cryptocurrency theft.
According to on-chain analysis platform Lookonchain, on December 30th, this Ethereum address sold large amounts of tokens including UNI, LINK, CRV, and YFI in a single transaction. The sale included approximately 226,961 UNI tokens worth about $1.36 million; 33,215 LINK tokens valued at nearly $410,000; 845,806 CRV tokens worth around $328,000; and more than 5 YFI tokens valued at approximately $17,500. Additionally, the address also liquidated or reduced holdings of other tokens.
On-chain tracking indicates that this wallet is closely linked to the 2021 Indexed Finance hack and the 2023 KyberSwap attack. Indexed Finance was attacked that year due to flash loan and price manipulation vulnerabilities, resulting in losses of about $16.5 million. The attacker claimed their actions complied with smart contract rules, sparking widespread controversy over DeFi mechanism design.
Later, in November 2023, the Elastic liquidity pool of KyberSwap was repeatedly exploited across multiple blockchains, draining nearly $49 million. Following the attack, the hacker even attempted to extort the protocol team by offering to return some assets, further shaking the market.
In February 2025, U.S. law enforcement released indictment documents accusing 22-year-old Canadian suspect Medjedovic of carrying out the two aforementioned attacks. Prosecutors stated that he laundered the stolen assets through mixers and cross-chain bridges, and pressured the KyberSwap team after the attacks. The suspect remains at large.
The reactivation of this wallet also reflects the severe risks of cryptocurrency theft in 2025. According to Chainalysis data, the estimated losses from crypto asset theft in 2025 range between $2.7 billion and $3.4 billion. Over 60% of these losses are related to centralized platforms, and many incidents are believed to be connected to North Korean hacking organizations. Although the average loss per individual wallet has decreased, the overall security situation remains grim.