Balancer Exploiter Begins Moving Funds, Mirroring Laundering Patterns From KelpDAO Hack

TL;DR:

• The Balancer exploiter reactivated wallets that had been dormant for five months and began converting 1,100 ETH into BTC through THORChain.
• Funds stolen from Balancer amount to approximately $120 million in ETH, and the laundering pattern replicates the one used in the KelpDAO hack.
• ThorChain recorded a daily volume of $70 million on April 24, its highest level since May 2025, driven by these operations.

The Balancer exploiter reactivated wallets that had remained inactive for five months and began moving funds through ThorChain, the decentralized protocol known for operating without censorship capabilities over its liquidity pools. Within the span of one hour, the attacker transferred 1,100 ETH to an intermediary address and converted them into BTC, replicating the same scheme used to move the funds from the KelpDAO hack.

The original theft amounted to approximately $120 million in ETH. The immediate impact on the asset’s price was limited: ETH was trading just above $2,300 at the time of the transactions, while BTC pulled back to $77,700. The decision to convert the funds stolen from Balancer into BTC is unusual, as groups behind this type of exploit typically keep assets in ETH to mix them, or take refuge in censorship-resistant stablecoins such as DAI.

From Balancer to THORChain

The choice of ThorChain was entirely deliberate. The protocol does not function as a mixer—movements are traceable on-chain—but its 95 active nodes operate in a fully permissionless manner, with no mechanisms to intercept transactions or freeze funds. John-Paul Thorbjornsen explained that the network initially had admin keys that allowed new network states to be proposed, though nodes could override them. One year ago, ThorChain decided to eliminate that mechanism entirely.

The protocol’s daily volume climbed to $70 million on April 24, compared to a usual average of $20 million. The bulk of that activity was concentrated in ThorChain’s native DEX. Only Arbitrum and some Aave vaults took preventive measures to block funds following the recent hacks; in most cases, exploiters manage to move and launder their assets without significant difficulty.

ZCash Adds Another Layer of Privacy

On a separate front, ThorChain announced the integration of native swaps with ZCash, with a gradual activation that began on April 24. The privacy protocol allows transactions to be shielded, potentially adding an additional layer of opacity to on-chain swaps. Following the announcement, ZEC climbed from a local low of $316 to $342.32.