Balancer exploiter swaps millions in ETH for BTC on ThorChain

On April 24, wallets linked to the Balancer exploit began converting stolen ETH into BTC using ThorChain. The funds had been idle for roughly five months after the breach, which originally yielded nearly $120 million in ETH. On-chain data shows about 1,100 ETH moved in an hour.

Transfers used ThorChain’s decentralized liquidity pools. Some ETH was routed first to an intermediary address before being swapped for bitcoin. Monitors tracking the flows tied the activity to wallets used in earlier breaches, including those linked to the KelpDAO incident.

ThorChain records make swaps visible on public ledgers while its permissionless design prevents third parties from blocking or reversing transactions once they are submitted. The network runs roughly 95 active nodes and removed centralized admin keys about a year ago. John-Paul Thorbjornsen wrote, “Initially, ThorChain had admin keys to propose a new network state, but nodes could override that decision.” He added that the admin mechanism was removed roughly a year ago.

On-chain volumes on ThorChain rose to about $70 million on April 24, compared with a typical daily swap volume near $20 million. Most of the volume occurred on ThorChain’s native decentralized exchange rather than through ThorWallet or the Ruji Trade DEX.

Attackers have previously left stolen funds in ETH for mixing or moved value into censorship-resistant stablecoins such as DAI. Converting ETH to BTC lowers the chance that individual wallets will be blacklisted or frozen. At the time of the swaps, ETH traded just above $2,300 and BTC traded near $77,700. Observers noted that the single-hour flows of roughly 1,100 ETH are small relative to overall market liquidity.

Some platforms have locked or isolated funds in response to recent hacks to limit contagion. ThorChain has stated it will not intercept or freeze assets on its network. The protocol also announced plans to add native Zcash swaps; ZEC rose from about $316 to $342.32 after the announcement.

Transactions remain traceable on public ledgers, and blockchain investigators and law enforcement can follow the flows. However, ThorChain’s protocol-level limits on censorship mean stopping or reversing swaps would be difficult without cooperation from centralized services in the broader ecosystem.