The Balancer exploit has taken a new turn as the attacker behind the $117 million breach began laundering large amounts of stolen Ethereum through Tornado Cash. Blockchain analysts reported fresh activity on November 15, showing the hacker funneling 2,000 ETH—worth roughly $6.36 million—into the privacy protocol within just one hour. The move strongly indicates that the attacker has abandoned any intention of negotiating a white-hat return.
Hacker Converts Stolen Tokens Before Laundering
In recent days, the Balancer attacker has been steadily swapping ETH liquid staking tokens (LSTs) and other non-ETH assets for pure ETH. This conversion phase marked a critical shift in behavior, signaling that the hacker was preparing to cash out rather than communicate with Balancer or negotiate any form of settlement.
Monitoring accounts report that nearly all stolen tokens have now been consolidated into ETH. Earlier updates showed the Balancer hacker controlling roughly 25,300 ETH, valued at nearly $92 million. As these conversions accelerated, observers anticipated the start of the laundering stage—and that moment has now arrived.
The attacker has been using Tornado Cash in repeated batches of 100 ETH per transaction. Dozens of deposits were recorded on-chain in rapid succession, flooding the Tornado Cash router with fresh inflows. Each deposit carried small gas fees, reflecting a carefully structured distribution pattern aimed at minimizing traceability. Once funds are mixed in Tornado, recovering them becomes extremely difficult.
$5,000+ ETH Still in Wallets After Latest Laundering Wave
Even after the 2,000 ETH funneled through Tornado Cash, the wallet labeled “Balancer Exploiter 7” still holds more than 1,700 ETH at the latest count. Previous movements showed inflows from additional exploiter-linked wallets, suggesting coordinated fund distribution across multiple attacker-controlled addresses.
This kind of multi-wallet structure is typical in large-scale hacks. It helps spread risk, obfuscate tracking efforts, and slow down investigators. Additional exploit-related wallets remain active as well, sending ETH back and forth before routing new batches into Tornado Cash. These on-chain patterns suggest the laundering phase may continue over the coming hours and days.
Stakewise Recovers Partial Funds, But Hack Remains Massive
Earlier this month, Stakewise managed to recover 5,041 osETH—worth nearly $19.3 million—via a contract call. This partial success reduced the Balancer hacker’s total stolen holdings from $117 million to roughly $98 million. Even so, more than half of the remaining assets have since been converted into ETH. The attacker’s accelerating laundering activity signals they have no interest in bounty offers or return negotiations—marking a clear departure from other high-profile exploits where hackers sought dialogue.
Tornado Cash Likely Marks the Endgame
With the attacker now aggressively pushing ETH through Tornado Cash, the crypto community views this as the final phase of the Balancer exploit. Once the ETH is dispersed through the mixing protocol, the trail effectively goes cold, leaving Balancer and affected users with limited recovery options. Investigators will continue analyzing on-chain activity, but for now, the Balancer attacker appears intent on making a clean exit—one 100-ETH deposit at a time.
