Exploiter behind Balancer breach swaps Ethereum holdings for Bitcoin

The Balancer exploiter has started moving funds from their known wallets. The laundering resembles the operations around the KelpDAO hack, using ThorChain for swapping the funds.

The Balancer hacker, which may be the same entity as the KelpDAO exploiter, has started moving funds. 

As in the case of KelpDAO, the hacker used ThorChain for decentralized swapping. While the ThorChain coin movements can be traced, they cannot be censored, as other bridges or DeFi services have done.

The Balancer hacker swapped ETH for BTC and sent some of the ETH to an intermediary address. 

Will the Balancer exploiter affect the market?

The Balancer exploiter stole nearly $120M in ETH, leaving the funds to sit idle for five months. The exploiter moved 1,100 ETH in an hour and started converting the coins to BTC. 

At this rate, the hacker may have a limited effect on ETH prices. ETH still traded just above $2,300, while BTC declined to the $77,700 range. 

The same technique may be used to launder funds from the Bybit and BTC Turk hacks, which may be controlled by the same hacker group. The decision to buy BTC is unprecedented, as usually, the hackers store their funds in ETH for mixing or in censorship-resistant stablecoins like DAI.

ThorChain increases activity

ThorChain activity increased to the highest level for the past year. The chain does not work as a mixer, which makes the funds traceable. However, swapping to BTC means a minimal chance of blacklisting wallets or freezing funds.

ThorChain carries around $20M in daily swap volumes, but as of April 24, volumes remained elevated at around $70M. Most of the volume is concentrated on the native ThorChain DEX, with almost no activity through ThorWallet swaps and the Ruji Trade DEX. 

The network does not work as a mixer and does not disguise the origin of funds. However, the liquidity pools cannot be censored, as the team has no right to override block confirmations. The network relies on 95 active nodes, which are entirely permissionless and are not subjected to additional voting or any tools to intercept funds. 

John-Paul Thorbjornsen explained that initially, ThorChain had admin keys to propose a new network state, but nodes could override that decision. Two teams held the admin keys, but in the end, ThorChain decided to remove the mechanism a year ago. 

ThorChain became the focus of traders as recent hacks raised the discussion of not allowing hackers to get away with stealing funds. So far, only Arbitrum and several Aave vaults have locked funds to prevent further contagion. For most hacks, the exploiters usually manage to move and launder the funds. 

ThorChain to add ZCash trading

After the recent hacks, ThorChain doubled down on its privacy narrative. The chain has previously stated it will always refuse to intercept funds, even from high-profile hacks. 

Recently, ThorChain announced it would add native ZCash swapping. 

Zcash is now enabled on THORChain.⚡️

Trading will begin in the coming weeks as nodes add support and Bifrost scanning goes live.

The progressive rollout of native zcash:native swaps on THORChain has officially begun.

— THORChain (@THORChain) April 24, 2026

ZCash offers additional security and privacy options, such as veiling transactions. With the addition of ZEC, ThorChain may offer another way to disguise funds through on-chain swaps. 

Following the news, ZEC rallied from a local low of $316 to $342.32.

If you want a calmer entry point into DeFi crypto without the usual hype, start with this free video.