Old Exploits, Same Playbook .... Funds on the Move Again . after lying low for a while, the wallets tied to the Balancer exploit are active again, pushing another 5,609 $ETH (~$13M) through THORChain over the past 9 hours. it lines up with what we’ve seen before—funds get routed across chains, broken up, and gradually distanced from their origin.

This traces back to the late-2025 hack where over $116M was drained, and the behavior still mirrors patterns often associated with Lazarus Group... especially the mix of cross-chain swaps and repeated use of tools like Tornado Cash for obfuscation. there are also overlaps being discussed with the Aave incident, though attribution in cases like this is never fully straightforward.
Overall, this doesn’t look like a one-off transfer—it feels like another phase of systematic laundering. once assets start moving through protocols like THORChain and mixers, the trail gets thinner, and recovery becomes a lot harder.
address: 0xb01c9b9ADDbe94b657861a90e1C1333771E8b5D1