The Balancer exploiter has resurfaced after a five-month dormant period, initiating the movement of stolen funds on April 24, 2026. According to Lookonchain, the attacker swapped approximately 1,100 ETH (worth around $2.55 million) for Bitcoin within a single hour, using THORChain as the primary cross-chain swapping protocol. The exploiter originally stole nearly $120 million in Ethereum from Balancer in December 2025 and has now begun converting the assets into BTC.
This laundering approach mirrors the tactics observed in the KelpDAO hack, where the same entity may have been involved. The use of THORChain allows the hacker to swap assets across chains in a decentralized and censorship-resistant manner. While THORChain transactions are fully traceable, they cannot be blocked or reversed — unlike centralized bridges or DeFi services that have previously frozen funds. The attacker’s strategy appears designed to fragment the funds across multiple wallets and swap types, complicating forensic tracking.
THORChain's daily swap volumes surged to approximately $70 million on April 24, significantly above its typical $20 million average. The network operates via 95 permissionless nodes, and has no admin keys or governance mechanisms to intercept or block transactions. John-Paul Thorbjornsen noted that while THORChain initially had admin key capabilities, these were removed over a year ago. The chain has repeatedly stated it will not censor transactions, even in high-profile hacks.
Separately, THORChain announced the addition of native ZCash (ZEC) trading. The progressive rollout of ZEC swaps has begun, with full trading expected in the coming weeks. ZCash enables private veiled transactions, offering a potential additional layer of obfuscation for fund movements. Following the announcement, ZEC’s price rallied from a local low of $316 to $342.32.
