Balancer Exploiter Reappears After 5 Months, Drains $ETH Through THORChain

The notorious Balancer exploiter has resurfaced recently, getting wider attention across the crypto community. Hence, 5 months after the Balancer exploit, the attacker has reappeared, swapping funds via THORChain.

As per the data from Lookonchain, the exploiter is actively swapping Ethereum ($ETH) into Bitcoin ($BTC). Particularly, within one hour, the attacker has shifted nearly 1,100 $ETH coins, indicating renewed activity following months-long silence.

The Balancer exploiter, who stole nearly $120M, is active again after 5 months and is laundering funds by swapping $ETH into $BTC through THORChain. Over the past hour, the exploiter moved 1,100 $ETH ($2.55M) and is converting it into $BTC. pic.twitter.com/ORfzNEFmeE

— Lookonchain (@lookonchain) April 24, 2026

Balancer Exploiter Rewakes from 5-Month Sleep to Swapping $2.55M from $ETH to $BTC

Following exploiting up to $120M from Balancer, the exploiter has remained inactive for 5 months. Nonetheless, now the attacker has again resurfaced, swapping $ETH for $BTC with the use of THORChain.

In this respect, a total of $2.55M (1,100 $ETH) has been swapped within 1 hour. So, this development underscores the current challenges related to tracking siphoned crypto assets across diverse decentralized liquidity ecosystems.

As a result, the exploiter is reportedly attempting to obscure and fragment the laundering procedure. Specifically, the renewed transactions now highlight a systemic conversion plan, with the funneling of $ETH via rapid swaps.

Cross-Chain Obfuscation Challenges Investigators

The transfer records additionally disclose several swap executions conducted on THORChain, taking into account swaps of up to 348 $ETH coins into 11.84 $BTC coins. The respective swaps show the tight coupling of settlement, inference requests, and authorization by the exploiter within one atomic stream. This guarantees predictable costs along with dispersing assets.

According to Lookonchain, with the fragmentation of transactions across diverse swap types and wallets, the exploiter is complicating forensic tracking and improving obfuscation. Additionally, the Balancer exploiter’s reactivation signifies the consistent vulnerabilities present in DeFi.

The $ETH laundering worth millions via THORChain raises caution for market investigators and reaffirms the urgent requirement for improved monitoring instruments to deal with highly sophisticated laundering strategies across chains.