Hacker-Linked Ethereum Wallet Reactivates, Offloads $2M in Tokens After Year of Dormancy

Quick Breakdown 

• A wallet linked to major DeFi exploits sold over $2 million in tokens after a year of inactivity
• The address is connected to the Indexed Finance (2021) and KyberSwap (2023) attacks.
• Crypto thefts in 2025 hit record levels, driven largely by centralized platform breaches.

 

An Ethereum wallet previously tied to major decentralized finance exploits has resurfaced after nearly a year of inactivity, dumping over $2 million in tokens in a sudden burst of on-chain activity.

Dormant exploit wallet springs back to life

Blockchain analytics firm Lookonchain flagged the activity on December 30, revealing that an address labelled 0x3EBF executed multiple large token sales within a short time frame.

The wallet(0x3EBF) linked to Indexed Finance and Kyber Network Exploiter resumed activity after 1 year of dormancy, dumping:

226,961 $UNI($1.36M)
33,215 $LINK($410K)
845,806 $CRV($328K)
5.25 $YFI($17.5K)https://t.co/2kniLaUA6J pic.twitter.com/uW4JAD44z1

— Lookonchain (@lookonchain) December 30, 2025

On-chain data shows the wallet sold 226,961 UNI, valued at roughly $1.36 million; 33,215 LINK, worth about $410,000; and 845,806 CRV, valued at nearly $328,000. Just over 5 YFI, worth approximately $17,500.

Several smaller token balances were also reduced, bringing total sales to more than $2 million.

Ties to Indexed Finance and KyberSwap exploits

The wallet has been linked to funds

during the Indexed Finance exploit in 2021 and the KyberSwap attack in 2023.

Indexed Finance suffered losses of around $16.5 million after its index pools were manipulated using flash loans and pricing distortions. The attacker later claimed the transactions complied with the protocol’s smart contract rules.

KyberSwap’s Elastic liquidity pools were drained in November 2023, resulting in losses of nearly $49 million across multiple blockchains.

Indictment filed, suspect still at large

In February 2025, U.S. authorities unsealed an indictment

Andean Medjedovic, a 22-year-old Canadian national, of orchestrating both attacks.

Prosecutors allege Medjedovic laundered stolen funds through crypto mixers and cross-chain bridges and attempted to pressure KyberSwap’s team after the exploit. He has not been apprehended and remains at large.

Wallet movement underscores persistent security risks

The wallet’s reactivation comes amid a surge in crypto-related thefts in 2025. According to Chainalysis’s

s, total losses this year ranged from $2.7 billion to $3.4 billion.

Unlike previous cycles dominated by DeFi exploits, most losses in 2025 were linked to centralized platforms. More than $2 billion, or roughly 60%, of stolen funds were attributed to entities connected to North Korea.

The year’s largest breach was the $1.5 billion Bybit hack in February, followed by major incidents at Cetus DEX ($223 million) and Balancer ($128 million). While individual wallet compromises surged to over 158,000 cases, the average loss per victim declined.