- Balancer Hacker swapped 7,000 ETH for 204.7 BTC through THORChain as tracing widened.
- KelpDAO attacker moved nearly 75,700 ETH into BTC and generated $910K in THORChain fees.
- Cross-chain swaps are raising pressure on exchanges, bridges, and blockchain analytics firms.
The Balancer Hacker moved stolen funds this week after a wallet tied to the November exploit converted ETH into Bitcoin through THORChain. The swaps occurred on-chain, where analysts tracked activity that mirrored the recent KelpDAO exploiter’s route. The movement drew attention as both cases used cross-chain liquidity to shift stolen ETH away from Ethereum.
According to on-chain analyst Ember, the Balancer-linked wallet swapped 7,000 ETH for 204.7 BTC, worth about $15.88 million. The wallet still held 15,000 ETH, valued at about $34.65 million, on Ethereum, plus 204.7 BTC on Bitcoin.
THORChain Route Links Two Exploit Trails
The timing followed a larger conversion by the KelpDAO exploiter. According to reports, the attacker swapped nearly all 75,700 ETH, valued at about $175 million, into BTC within roughly a day and a half.
That activity generated about $910,000 in fee revenue for THORChain, according to the same report. Arkham Intelligence also tracked 75,701 ETH moving into new wallets on April 21 before routing through THORChain and Umbra.
The parallel route placed both fund movements under close monitoring. In both cases, attacker-controlled wallets used THORChain to move from ETH into BTC across separate transactions and protocols.
KelpDAO Breach Remains Major 2026 Case
The KelpDAO incident remains one of the largest DeFi breaches in 2026. Security firm Halborn said the attacker stole $292 million after exploiting compromised infrastructure. Halborn also linked the theft to a DDoS-driven failure around a 1-of-1 verifier setup.
The firm further acknowledged that suspected Lazarus-linked actors may have accelerated their exit after Arbitrum’s Security Council froze about $71 million in stolen ETH. That freeze added urgency to the fund movement. The attacker moved large ETH balances into new wallets before routing them through cross-chain paths.
Balancer Losses Continue After November Exploit
Balancer’s case began with a November 2025 exploit targeting Balancer V2 ComposableStablePool contracts, according to Check Point Research. The attack drained $128.64 million across six blockchains in under 30 minutes.
Crystal Intelligence later reported that losses fell to $98 million after a $19 million recovery effort. However, much of the stolen funds remained under the attacker’s control.
Overall, the latest swaps show how exploiters use permissionless liquidity during post-hack fund movement. For exchanges, bridges, and analytics firms, any cash-out attempt remains the next clear pressure point.
Related: Two Hacks, $606M Lost, Yet Ethereum Holds Above $2,300/
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
