Balancer Hacker Launders 2,000 ETH Through Tornado Cash

The Balancer exploit has taken another turn. As the attacker behind the $117 million breach began laundering large amounts of stolen Ethereum through Tornado Cash. Blockchain watchers flagged a fresh wave of activity on November 15. It shows the Balancer hacker pushing 2,000 ETH, worth around $6.36 million, into the privacy protocol within a single hour. The move strongly suggests the attacker has abandoned any chance of negotiating a white-hat return.

Hacker Converts Stolen Tokens and Begins Laundering

Over the past few days, the Balancer hacker has been steadily swapping ETH liquid staking tokens (LSTs) and other non-ETH assets for straight ETH. This conversion phase marked a critical shift in behavior. This signaled that the attacker was preparing to cash out. Rather than communicate with Balancer or negotiate a settlement.

According to monitoring accounts, nearly all stolen tokens have now been consolidated into ETH. Earlier updates revealed the Balancer hacker controlled around 25,300 ETH, valued at nearly $92 million. As these conversions piled up. Observers expected the attacker to begin the laundering phase and now that moment has arrived.

The hacker used Tornado Cash in batches of 100 ETH per transaction. Dozens of deposits were recorded in rapid succession on-chain. It is flooding the Tornado Cash router with fresh inflows. Each deposit included small gas fees, showing a carefully planned distribution pattern designed to reduce traceability. Once these funds mix inside Tornado, recovering them becomes extremely difficult.

$5,000+ ETH Still in Wallets After Laundered Amount

Even with the 2,000 ETH now washed through Tornado Cash. The wallet labeled “Balancer Exploiter 7” still holds more than 1,700 ETH at the time of monitoring. Earlier movements showed inflows from other associated exploiter wallets. This suggests coordinated asset distribution among multiple addresses controlled by the attacker.

This multi-wallet structure is common in major exploits. It helps attackers spread risk and complicate tracking. Additionally, other exploit-linked addresses remain active. This sends ETH back and forth before routing more batches into Tornado Cash. These patterns indicate the laundering process may continue over the coming hours and days.

Stakewise Recovers Partial Funds, But Hack Remains Major

Earlier this month, Stakewise successfully used a contract call to recover 5,041 osETH, worth nearly $19.3 million, from the attacker. That partial win reduced the Balancer hacker’s total stolen holdings from $117 million to approximately $98 million. Still, more than half of the stolen assets have been converted to ETH. The Balancer hacker’s accelerating laundering activity implies they are uninterested in any remaining bounty or return deals. This is a clear departure from other high-profile exploits where attackers engaged in negotiations.

Community Watches as Tornado Cash Becomes the Endgame

With the attacker is now aggressively washing ETH through Tornado Cash. The crypto community sees this as the final phase of the Balancer exploit. Once the ETH disperses, the trail effectively goes cold. It leaves Balancer and affects users with few recovery options. Investigators will continue to track patterns. But for now, the Balancer hacker appears determined to exit with their gains, one 100 ETH deposit at a time.