Dormant DeFi Hacker Wallet Sells $2M in Crypto, Manhunt Ongoing

A wallet tied to the Indexed Finance and KyberSwap hacks sold over $2 million in crypto after a year of dormancy, reigniting concerns over DeFi security as authorities pursue the alleged perpetrator.

A wallet linked to the Indexed Finance and KyberSwap exploits has reactivated after a year of inactivity, selling over $2 million in tokens including UNI, LINK, CRV, and YFI in a short period. The wallet, associated with the 2021 Indexed Finance hack and the 2023 KyberSwap exploit, sold approximately 226,961 UNI ($1.36 million), 33,215 LINK ($410,000), 845,806 CRV ($328,000), and over 5 YFI ($17,500), along with smaller token balances. These incidents resulted in losses of about $16.5 million for Indexed Finance and nearly $49 million for KyberSwap, both involving sophisticated manipulation of DeFi protocols. Following the KyberSwap attack, the perpetrator attempted to extort the protocol. In February 2025, U.S. authorities unsealed an indictment against a Canadian national, alleging involvement in both attacks, money laundering, and extortion. The individual remains at large. The year 2025 has seen record crypto thefts, with losses estimated between $2.7 billion and $3.4 billion, mostly from centralized platforms.