The Balancer hack attacker has converted 1,100 Ethereum into Bitcoin. The hacker’s return has sparked caution and speculation among community members. The choice of Bitcoin indicates that the hacker is taking a calculated approach. The $120 million Balancer hack is back in the spotlight after five months. In the latest development, the attacker has resurfaced, moving 1,100 Ethereum tokens. After months of silence, the attacker is once again converting funds, putting the crypto community back on alert. Balancer Hack Exploiter Resurfaces, Moves ETH According to Lookonchain data , the attacker behind the massive Balancer hack is now active. After remaining dormant for almost five months, the exploiter is now converting Ether into Bitcoin via THORChain. On-chain data shows that the Balancer hack exploiter has started moving funds and swapped 1,100 ETH, worth $2.55 million, into Bitcoin. The transaction was carried out via THORChain, a decentralized protocol that allows cross-chain swaps without intermediaries. For context, the Balancer occurred in late 2025. It is considered one of the biggest DeFi hacks. The attacker reportedly used a vulnerability in Balancer’s smart contracts to drain more than $120 million in crypto. It is worth noting that the latest move comes following the KelpDAO exploit . Notably, this move has raised concerns about the hacker’s money laundering activities. While many believed that the Balancer hacker had disappeared as he went silent for many months, his sudden appearance has sparked caution. The use of THORChain shows a calculated approach. This is because such platforms are often used to make transactions harder to trace. By breaking the funds into smaller transfers, the hacker can avoid detection while slowly converting Ethereum into Bitcoin. This indicates that the Balancer hack attacker is slowly working to launder his stolen funds. Why Bitcoin is the Preferred Choice? Bitcoin often becomes a choice in the course of money laundering operations. First of all, this may be explained by the asset’s high liquidity and its popularity among other coins. It also demonstrates the possibility of transferring and exchanging funds without additional effort within the framework of numerous crypto exchanges. In addition, the coin possesses considerable market depth, thus large sums of funds may be moved with ease. Despite the relatively low value of the sum, around $2.5 million, it indicates that the attacker has an option to operate on the rest of the funds. The transfer is done repeatedly, which indicates that this operation becomes a regular procedure in managing the stolen funds. Therefore, the choice of BTC becomes quite understandable. By slowly converting assets into BTC, the hacker can spread out transactions over time. This can also reduce traceability and maintain flexibility in moving funds across platforms. Unveiling Possible Strategy Behind the Transfers In addition to his planned strategy, there may be other reasons for the latest ETH-BTC conversion. The recent transfers suggest that the Balancer hack attacker is testing how closely the wallet is being monitored. Small, controlled transactions can help gauge whether tracking systems or exchanges are actively flagging activity linked to the hack. Another possible reason is the exploiter’s portfolio reshaping. Instead of simply hiding funds, the attacker may be repositioning assets. If the goal is long-term holding, Bitcoin is acting here as the base asset. The Balancer hack attacker may also be coordinating with broader market conditions. Moving funds in phases allows the attacker to take advantage of liquidity windows and price stability.
