On April 24, 2026, an on-chain action that quickly tightened market nerves reappeared: An address identified as related to the Balancer attack event became active again and began exchanging large amounts of ETH for BTC through THORChain. On-chain analyst Yu Jin observed that this address had confirmed the completion of a swap of 7000 ETH, corresponding to 204.7 BTC, valued at approximately 15.88 million dollars based on the then-current scale; more crucially, at the time of reporting, this conversion process was still ongoing.

This was not an ordinary large-scale reallocation. The capital path directly shifted from Ethereum assets to Bitcoin assets, drawing the market's attention back to two more sensitive questions: why exactly now, and whether the difficulty of subsequent tracking and reclamation is further increasing as assets continue to migrate via THORChain. For an address that has been marked as a Balancer attacker, this renewed action alone was enough to indicate that the risk has not passed.

7000 ETH is being exchanged for BTC

What needs to be confirmed right now is not that this money “has moved again,” but that it is being reconfigured in a very clear way. On-chain analyst Yu Jin's monitoring shows that the related address is exchanging ETH for BTC through THORChain. By the time of reporting, this process had completed one segment: 7000 ETH was exchanged for 204.7 BTC, valued at around 15.88 million dollars, and the cross-chain swapping was ongoing, not merely a few tentative scattered transfers.

This distinction is important. Simply breaking funds apart and distributing them to more addresses is more of an on-chain level “diffusion”; but directly switching from ETH to BTC means that assets have begun to depart from their original track, entering another set of liquidity and tracking context. Especially in the case of THORChain, which supports direct exchange of native assets without bridging or wrapping assets, this action resembles an active reallocation rather than a simple transfer.

Therefore, what the market should truly focus on right now is not just the figure of 15.88 million dollars itself, but that these funds have completed a substantial shift from Ethereum assets to Bitcoin assets. For an address that has been continuously associated with an attack event by outsiders, this means that the focus of subsequent observation will also change: whether it will continue to exchange more ETH for BTC and what paths the funds will follow after entering the new asset track.

Why do hackers prefer THORChain

To understand why this capital is shifting from ETH to BTC, the key lies not only in “what was exchanged” but also in “through what it was exchanged.” The frequent appearance of THORChain in similar narratives is not accidental. It supports direct exchanges between native assets, does not rely on traditional bridges, and does not require assets to be wrapped into representations on another chain, meaning the path from ETH to BTC can be shortened and executed more flexibly.

This is particularly important for an address continuously associated with an attack event. The route observed this time is not about the funds continuing to circulate within the Ethereum system but has explicitly followed the cross-asset migration path from ETH to BTC. The research brief also mentioned that the anonymity and anti-censorship features of THORChain have long been commonly used by hackers for asset transfers. In the context of this reallocation, it at least provides a more direct exit method: no bridging layer, no additional wrapping steps, minimizing intermediate steps, thus reducing exposure along the path.

Of course, the assessment of motivation will still remain speculative. One possibility is to evade tracking. If the funds remain on a single chain, the on-chain profile and behavior associations will be more continuous; however, once the switch from ETH to BTC is completed, the dimensions of observation, tracking methods, and even subsequent cooperation difficulties may change accordingly. A second possibility is asset preservation and liquidity considerations. For large amounts of capital, shifting assets to a currency with stronger absorption capacity and deeper liquidity is, by itself, a choice that can be understood.

However, it should be emphasized that these are not confirmed intentions. What can currently be confirmed is that this address is using THORChain to exchange ETH for BTC; and from the choice of path itself, this resembles a calculated operation rather than a random one-time transfer.

7000 first, about 15,000 ETH

Because this resembles a planned asset dispatch, market attention is unlikely to remain on the completed transaction. The swap of 7000 ETH for 204.7 BTC, equivalent to about 15.88 million dollars, is certainly striking, but if we place it back against the entire timeline, this transaction seems more like “a part that has gone first,” rather than the end of the story.

What truly raises concern is that this suspected attacker may still hold more chips. According to a single source, this address still holds approximately 15,000 ETH on the Ethereum chain. It is important to emphasize that here it can only be stated as “approximately 15,000 ETH”: the precise source of this portion of holdings, current accumulation status, and how it will be disposed of subsequently remain unclear according to the research brief. In other words, what the market is facing now is not a set of complete answers that have already landed, but a process that has not yet ended.

This will directly change the focus of observation. The completed swap of 7000 ETH only confirms that the path of transfer from ETH to BTC has been opened; and as the swap was still ongoing at the time of reporting, it further indicates that the asset dispatch itself has not yet ended. If the estimate of about 15,000 ETH is valid, then there is theoretically still room for subsequent exchanges or further transfers to new addresses. For on-chain trackers, the suspense is no longer just “what did he just sell,” but “how much does he still have left, and where will the next move come from?”

Recovery window narrows, Balancer

Because of this, the impact of this swap goes far beyond the mere completion of the conversion of 7000 ETH into 204.7 BTC, approximately 15.88 million dollars. More critically, it has pulled a case that was gradually fading from view back to the center of discussions on recovery and security. According to a single source, this reactivated address is linked to the Balancer attack event in November 2025; at the time, the research brief stated that the attacker exploited vulnerabilities to steal significant funds, but did not provide a confirmed total stolen amount in this round of reports. This means that what the market is now seeing is a funding path that may have restarted and is linked to the old Balancer case, but this attribution itself still needs to preserve source boundaries and cannot be taken directly as a conclusion after cross-validation by various parties.

What truly makes the situation more sensitive is the change in the environment in which the assets are located. Previously, the related funds at least remained within the Ethereum chain, which is easier to continuously observe, mark, and link; however, once they complete the switch from ETH to BTC via THORChain, the funds implicitly step out of the originally familiar observation framework. THORChain supports the direct exchange of native assets without the need for bridges or wrapped assets; the research brief has also explicitly noted that its anonymity and anti-censorship features are often used by hackers for asset transfers. In this context, whether tracking the flow, trying to freeze, or continuously gathering evidence for possible recovery actions, the difficulty may rise simultaneously.

This is also why Balancer is brought up again, not just because of the old matter being revisited, but because the “recovery window” itself may be narrowing. As long as funds remain on a relatively continuous and observable chain trajectory, trackers still have opportunities to continually piece together the puzzle around addresses, paths, and interaction subjects; but when assets start entering a new chain system, the original clues may be cut off and diluted, making each subsequent redistribution break the entire evidence chain more. In other words, this round of actions may not have definitively answered what the attackers intend to do, but it has been enough to remind the market that the follow-up to the Balancer event did not naturally end with the passage of time; it has merely entered a phase that is harder to handle.

From ETH to BTC, the next step is harder to trace

At this point, the only definitive conclusion that can be made is this: the address suspected of being related to the Balancer attack event has been moving, and significantly so. The core fact confirmed on-chain is that it was observed to be reactivated on April 24, 2026, and exchanged 7000 ETH for 204.7 BTC through THORChain, with a scale of approximately 15.88 million dollars, and the process was still ongoing at the time of reporting. However, pushing further back, many key details remain unverified—exactly when this round of swapping began and ended, whether the 204.7 BTC was still fully held at the time of reporting, and whether it will continue using THORChain to expand the swapping cannot yet be concluded.

This is why the risk is escalating, while the information remains incomplete. If the claim by a single source that it still holds approximately 15,000 ETH on the Ethereum chain is true, then the 7000 ETH currently seen may only be the first segment of actions, rather than the entire position; but before more on-chain evidence emerges, the outside world cannot confirm its complete holdings, complete pace, let alone confirm whether the final point really stops at BTC or continues into the next round of dispersion and transfer.

What is most worth keeping an eye on moving forward are actually three things:
● Whether the scale of this round of ETH to BTC exchange continues to expand;
● Whether the rumored remaining ETH will also transfer out simultaneously;
● Whether the exchanged BTC will start further dispersing and circulating.

If the latter two occur simultaneously, then the difficulty of tracking and subsequent handling costs will continue to rise; but until then, any speculation that exceeds the verified on-chain records should be held in check.

In other words, what is most important now is not to rush to provide a complete story, but to protect what has already been confirmed on-chain. Any involvement regarding so-called periods of silence, additional transfers, specific address attributions, or even finer operational paths, as long as they remain in the state of pending verification from a single source or research brief, should not be written as established facts. Regarding the follow-up to the Balancer event, the market has seen funds beginning to move; as for where they will move to, how long they will move, and how many cards are still left to play, the answers are still on-chain.

Join our community to discuss and grow stronger together!
Official Telegram community: https://t.me/aicoincn
AiCoin Chinese Twitter: https://x.com/AiCoinzh
OKX Benefits Group: https://aicoin.com/link/chat?cid=l61eM4owQ
Binance Benefits Group: https://aicoin.com/link/chat?cid=ynr7d1P6Z

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。