#BalancerAttackerResurfacesAfter5Months
In the world of DeFi, silence often precedes a storm. After nearly five months of total inactivity, the hacker behind one of the most significant exploits in Balancer Protocol’s history has officially resurfaced. On-chain data confirms that the attacker’s wallet is moving funds again, sending ripples of concern across the decentralized finance ecosystem.
The Current Movement: Laundering via THORChain
According to recent on-chain monitoring by *BlockBeats* and security firms, the attacker—who was responsible for draining nearly $120 million—began moving assets on April 24, 2026.
The attacker’s strategy appears focused on obfuscation and "cleaning" the stolen loot. Reports indicate that:
Asset Conversion: The hacker has been actively converting ETH to BTC.
THORChain Utilization: The attacker is leveraging the cross-chain liquidity protocol THORChain to swap assets, a common tactic used to break the "paper trail" across different blockchains.
Volume: In a single hour, over 1,100 ETH was moved and channeled through conversion processes.
A Quick Recap: The Original Exploit
The original attack occurred in late 2025, primarily targeting Balancer V2 Composable Stable Pools. The root cause was a sophisticated exploitation of a rounding-down flaw within the protocol's swap calculation logic. By manipulating the batchSwap function, the attacker was able to drain massive liquidity from the affected pools.
Why Does This Matter Now?
The "resurfacing" of a major hacker after a long hiatus is a critical event for several reasons:
1. Market Sentiment: It serves as a stark reminder of the persistent security risks within DeFi.
2. Selling Pressure: Large-scale movements of stolen ETH into BTC (and potentially into fiat gateways) can create localized selling pressure.
3. Regulatory Scrutiny: Such movements often trigger fresh investigations by cybersecurity agencies and exchange compliance teams (KYC/AML).
Closing Thoughts for the Community
As the attacker continues to move funds, decentralized protocols and centralized exchanges are likely on high alert. For users, this incident highlights the importance of using platforms with robust security measures and staying informed through real-time on-chain alerts.
Stay vigilant, and always do your own research (DYOR).
What do you think about the use of THORChain by hackers ?
#Binance #Balancer #CryptoSecurity #BlockchainNews $BTC $ETH $BNB