The hacker behind the Balancer protocol breach has initiated a major fund movement, swapping Ethereum holdings for Bitcoin using the decentralized cross-chain protocol ThorChain. This laundering technique mirrors the recent KelpDAO exploit, suggesting the same malicious entity may be responsible for both attacks. While ThorChain's transactions can be traced on-chain, they remain uncensorable, unlike other DeFi bridges and services that have imposed freezes. The exploiter has already transferred a portion of the stolen ETH to an intermediary address, signaling a well-orchestrated effort to obscure the funds' origin.

Will the Balancer exploiter affect the market?

The Balancer exploiter stole nearly $120M in ETH, leaving the funds to sit idle for five months. The exploiter moved 1,100 ETH in an hour and started converting the coins to BTC. 

At this rate, the hacker may have a limited effect on ETH prices. ETH still traded just above $2,300, while BTC declined to the $77,700 range. 

The same technique may be used to launder funds from the Bybit and BTC Turk hacks, which may be controlled by the same hacker group. The decision to buy BTC is unprecedented, as usually, the hackers store their funds in ETH for mixing or in censorship-resistant stablecoins like DAI.

ThorChain increases activity

ThorChain activity increased to the highest level for the past year. The chain does not work as a mixer, which makes the funds traceable. However, swapping to BTC means a minimal chance of blacklisting wallets or freezing funds.

ThorChain carries around $20M in daily swap volumes, but as of April 24, volumes remained elevated at around $70M. Most of the volume is concentrated on the native ThorChain DEX, with almost no activity through ThorWallet swaps and the Ruji Trade DEX. 

The network does not work as a mixer and does not disguise the origin of funds. However, the liquidity pools cannot be censored, as the team has no right to override block confirmations. The network relies on 95 active nodes, which are entirely permissionless and are not subjected to additional voting or any tools to intercept funds. 

John-Paul Thorbjornsen explained that initially, ThorChain had admin keys to propose a new network state, but nodes could override that decision. Two teams held the admin keys, but in the end, ThorChain decided to remove the mechanism a year ago. 

ThorChain became the focus of traders as recent hacks raised the discussion of not allowing hackers to get away with stealing funds. So far, only Arbitrum and several Aave vaults have locked funds to prevent further contagion. For most hacks, the exploiters usually manage to move and launder the funds. 

ThorChain to add ZCash trading

After the recent hacks, ThorChain doubled down on its privacy narrative. The chain has previously stated it will always refuse to intercept funds, even from high-profile hacks. 

Recently, ThorChain announced it would add native ZCash swapping. 

Zcash is now enabled on THORChain.⚡️

Trading will begin in the coming weeks as nodes add support and Bifrost scanning goes live.

The progressive rollout of native zcash:native swaps on THORChain has officially begun.

— THORChain (@THORChain) April 24, 2026

ZCash offers additional security and privacy options, such as veiling transactions. With the addition of ZEC, ThorChain may offer another way to disguise funds through on-chain swaps. 

Following the news, ZEC rallied from a local low of $316 to $342.32.

If you want a calmer entry point into DeFi crypto without the usual hype, start with this free video.