The world of decentralized finance (DeFi) was shaken after a hacker, responsible for last year’s major attack on the Balancer protocol in which approximately 120 million dollars’ worth of ETH was stolen, began to move these funds in recent hours for the first time since the incident. The attacker’s latest step involved swapping the stolen ETH for BTC using the decentralized exchange platform ThorChain, following five months of inactivity.
Rapid fund transfers and ThorChain’s pivotal role
The crypto community has focused on parallels between this Balancer hack and the recent KelpDAO incident, as the same tactic was used: converting stolen assets from ETH to BTC through ThorChain, which operates outside traditional regulatory oversight. In less than an hour, the attacker swapped a total of 1,100 ETH for Bitcoin, moving portions of these proceeds through intermediary wallets for further obfuscation.
ThorChain’s decentralized architecture enables real-time, on-chain tracking of transactions, but unlike classical DeFi bridges or centralized exchanges, it does not offer mechanisms for freezing or blacklisting funds. This makes it difficult for authorities to intervene or halt suspect transactions once they are on the network.
The network’s decentralized nature is upheld by 95 independent validator nodes. Although ThorChain originally utilized administrative keys, the team eliminated these about a year ago, ensuring that all on-chain transactions are now confirmed through community consensus, further minimizing centralized control.
Potential impact on ETH and BTC prices
Given the size of the moved funds relative to the broader market, analysts expect only a limited impact on ETH prices. The stolen amount represents a small fraction of total market capitalization, and as a result, ETH has remained above 2,300 dollars, while BTC has seen a drop to around 77,700 dollars.
According to data from CryptoAppsy, at the time of reporting, ZCash (ZEC) climbed from a local low of 316 dollars to 342.32 dollars, coinciding with heightened activities on ThorChain and debates sparked by recent high-profile hacks.
ThorChain’s official statement confirmed the completion of ZCash integration, noting: “ZCash’s native swaps will become gradually available as node operators on the chain provide full support in the coming weeks.”
The recent preference for trustless, on-chain swap solutions, rather than cross-chain bridges in incidents like the Balancer and KelpDAO exploits, is reigniting concerns about DeFi’s security and traceability. Emerging evidence suggests similarities between the latest attacks and previous incidents involving Bybit and BTC Turk, hinting that the same groups may be involved.
Record-breaking ThorChain swap volume and ZCash integration
ThorChain has achieved its highest transaction volumes in a year, with daily average on-chain swap amounts surging from 20 million dollars up to 70 million dollars as of April 24. This jump has been driven largely by the attention surrounding the Balancer and KelpDAO hacks. However, rival decentralized platforms like ThorWallet and Ruji Trade DEX saw little change, with nearly all activity concentrated on ThorChain’s native DEX.
ZCash’s recent addition to ThorChain as a natively supported swap asset has pushed the network further into the spotlight. Its privacy features and transaction shielding capabilities offer new escape routes for cybercriminals, and as ThorChain readies to enable ZCash swaps, demand for privacy-focused assets could intensify.
Despite not anonymizing the origins of funds, ThorChain’s structure and decentralization make it virtually impossible for third parties to freeze or intercept moves, a fact the team acknowledges as debate continues over on-chain transparency and regulatory compliance.
These developments reaffirm the role of DeFi-based swap networks as critical conduits, not only for legitimate users but also for hackers seeking to move and launder stolen assets.
