The wallet behind the Balancer exploit — roughly $120M drained in the November 2025 incident — is active again after five months of dormancy. On-chain trackers flagged the address moving 1,100 $ETH (~$2.55M) and routing the proceeds into $BTC via THORChain's cross-chain swap layer over the past hour.
Why it matters
THORChain remains the laundering route of choice for long-dormant exploit wallets because it lets attackers swap native assets across chains without touching a centralised venue or a KYC-gated bridge. Every resurfacing of an old thief through that router is a reminder that the swap layer's design — non-custodial, permissionless, cross-chain — is also a structural on-ramp for stolen funds.
Market impact
The single $2.55M move is small relative to the ~$120M still outstanding, but the pattern is what investigators watch: dormant → active → rotation. Expect more ETH-to-BTC swaps through THORChain as the exploiter continues to break up and convert the original haul.
Frequently asked questions
-
What happened with the Balancer exploit?
The wallet behind the Balancer exploit — roughly $120M drained in November 2025 — resurfaced on-chain after five months of dormancy and swapped 1,100 ETH (~$2.55M) into BTC via THORChain in the past hour.
-
How much ETH did the Balancer exploiter move?
The exploiter moved 1,100 ETH, worth approximately $2.55M, and began converting it into BTC through THORChain's cross-chain swap layer.
-
Why is the exploiter using THORChain to launder funds?
THORChain lets attackers swap native assets across chains without touching a centralised exchange or a KYC-gated bridge — non-custodial, permissionless, and cross-chain, which makes it a structural on-ramp for stolen funds.
-
Is $2.55M the total amount stolen?
No. The $2.55M is a single recent move. The original Balancer incident drained roughly $120M, most of which remains outstanding and subject to further conversion.
-
What happens next with the Balancer exploiter's funds?
The pattern — dormant → active → rotation — suggests more ETH-to-BTC swaps through THORChain are likely as the exploiter continues to break up and convert the original ~$120M haul. On-chain trackers are monitoring the destination BTC addresses.
WuBlockchain
WatcherGuru
TheBlock
CoinDesk
Crypto Capital Venture
CryptoSlate