DeFi exploiter moves 1,100 ETH via DEX

TLDR

A wallet tied to the 2025 Balancer exploit has woken up and moved 1,100 ETH through the cross chain DEX THORChain into BTC.

1. The Balancer exploiter, who stole nearly $120M in 2025, has resumed activity by swapping 1,100 ETH (about $2.5M) to BTC via THORChain.
2. Using a cross chain DEX and converting into BTC makes the stolen funds harder to trace and recover, highlighting a persistent structural weak spot in DeFi.
3. On chain analysts expect more transfers, so watchers are tracking this wallet and related flows for further laundering and possible protocol or law enforcement responses.

Deep Dive

1. What The Hacker Did

A wallet linked to the Balancer V2 exploit that drained nearly $120M in 2025 has reactivated after roughly five months of inactivity.

According to on chain monitoring reported by Bitcoin.com, the address moved 1,100 ETH (about $2.55M) through THORChain and converted it into BTC, in a single fresh wave of transactions from the dormant stash.

Multiple on chain analysts on X, including GemBooster, have flagged the same activity, noting that the exploiter has returned after 5 months of silence and that funds are now moving more regularly.

Confidence: high. The movement is confirmed across several independent tracking accounts and crypto media.

2. Why This Route Matters

THORChain is a cross chain DEX that lets users swap native assets across blockchains (for example ETH on Ethereum for BTC on Bitcoin) without centralized custody or KYC checks.

By routing stolen ETH through THORChain into BTC, the exploiter aims to:

1. Break the visible trail of funds across chains.
2. Exit the Ethereum ecosystem where blacklisting and contract level freezes are more common.
3. Park value in BTC, which trades on many venues and is harder to freeze or coordinate against.

Bitcoin.com notes that Thorchain has been used in several past laundering cases and that this move fits a broader 2026 pattern of dormant exploit funds becoming active again as market liquidity improves.

3. What To Watch Next

On chain watchers expect this 1,100 ETH transfer to be part of a longer series of moves rather than a one off. The exploiter still controls a much larger ETH balance from the original Balancer hack.

Key things to monitor now are:

1. Further transfers from the same wallet into THORChain, bridges, or mixers.
2. Any mitigation steps by Balancer, THORChain, or major exchanges, such as flagging or blocking known addresses.
3. Regulatory or law enforcement commentary, especially as similar exploits like the recent KelpDAO incident have already triggered security council freezes and coordinated DeFi United style responses.

For traders and DeFi users, this is a signal to keep an eye on exploit tracker dashboards, cross chain DEX flows, and any new blacklists or risk warnings that protocols publish.

Conclusion

The 1,100 ETH swap is a relatively small slice of the original Balancer haul, but it shows the exploiter is actively working to cash out, using cross chain infrastructure to complicate tracking.

The direct market impact from this single move is limited, yet it reinforces a bigger theme for DeFi in 2026: exploits can have long tails, with dormant funds reentering markets months later under more favorable liquidity conditions.