Balancer Hacker Copies KelpDAO THORChain Laundering Route

• Balancer Hacker swapped 7,000 ETH for 204.7 BTC through THORChain as tracing widened.
• KelpDAO attacker moved nearly 75,700 ETH into BTC and generated $910K in THORChain fees.
• Cross-chain swaps are raising pressure on exchanges, bridges, and blockchain analytics firms.

The Balancer Hacker moved stolen funds this week after a wallet tied to the November exploit converted ETH into Bitcoin through THORChain. The swaps occurred on-chain, where analysts tracked activity that mirrored the recent KelpDAO exploiter’s route. The movement drew attention as both cases used cross-chain liquidity to shift stolen ETH away from Ethereum.

According to on-chain analyst Ember, the Balancer-linked wallet swapped 7,000 ETH for 204.7 BTC, worth about $15.88 million. The wallet still held 15,000 ETH, valued at about $34.65 million, on Ethereum, plus 204.7 BTC on Bitcoin.

THORChain Route Links Two Exploit Trails

The timing followed a larger conversion by the KelpDAO exploiter. According to reports, the attacker swapped nearly all 75,700 ETH, valued at about $175 million, into BTC within roughly a day and a half.

That activity generated about $910,000 in fee revenue for THORChain, according to the same report. Arkham Intelligence also tracked 75,701 ETH moving into new wallets on April 21 before routing through THORChain and Umbra.

The parallel route placed both fund movements under close monitoring. In both cases, attacker-controlled wallets used THORChain to move from ETH into BTC across separate transactions and protocols.

KelpDAO Breach Remains Major 2026 Case

The KelpDAO incident remains one of the largest DeFi breaches in 2026. Security firm Halborn said the attacker stole $292 million after exploiting compromised infrastructure. Halborn also linked the theft to a DDoS-driven failure around a 1-of-1 verifier setup.

The firm further acknowledged that suspected Lazarus-linked actors may have accelerated their exit after Arbitrum’s Security Council froze about $71 million in stolen ETH. That freeze added urgency to the fund movement. The attacker moved large ETH balances into new wallets before routing them through cross-chain paths.

Balancer Losses Continue After November Exploit

Balancer’s case began with a November 2025 exploit targeting Balancer V2 ComposableStablePool contracts, according to Check Point Research. The attack drained $128.64 million across six blockchains in under 30 minutes.

Crystal Intelligence later reported that losses fell to $98 million after a $19 million recovery effort. However, much of the stolen funds remained under the attacker’s control.

Overall, the latest swaps show how exploiters use permissionless liquidity during post-hack fund movement. For exchanges, bridges, and analytics firms, any cash-out attempt remains the next clear pressure point.

Related: Two Hacks, $606M Lost, Yet Ethereum Holds Above $2,300/