balancer

What’s worth watching isn’t yet another “protocol is dying,” but rather: reconstruction is done, the product has been delivered, yet the revenue still doesn’t come back.
According to Cointelegraph, Balancer Labs CEO Marcus Hardt proposed an orderly shutdown of the protocol at a governance forum on Monday, and distributed the remaining treasury (currently worth more than $9 million) proportionally to $BAL holders. The context is that after an attack of about $128 million on the November 2025 v2 composable stable pools, the Labs were shut down in March and operations were streamlined—costs were cut, but v3 didn’t bring the revenue back.
DefiLlama data: the protocol’s revenue for the attack month fell from about $1.13 million in October to about $371,000 in November; by August 2026 it was down to roughly $56,800. The gist of Hardt’s own words is: the product can work, but it doesn’t sell enough; he underestimated the long-tail impact of the attack on the brand and adoption.

#BalancerAttackerResurfacesAfter5Months
In the world of DeFi, silence often precedes a storm. After nearly five months of total inactivity, the hacker behind one of the most significant exploits in Balancer Protocol’s history has officially resurfaced. On-chain data confirms that the attacker’s wallet is moving funds again, sending ripples of concern across the decentralized finance ecosystem.
The Current Movement: Laundering via THORChain
According to recent on-chain monitoring by *BlockBeats* and security firms, the attacker—who was responsible for draining nearly $120 million—began moving assets on April 24, 2026.
The attacker’s strategy appears focused on obfuscation and "cleaning" the stolen loot. Reports indicate that:
Asset Conversion: The hacker has been actively converting ETH to BTC.
THORChain Utilization: The attacker is leveraging the cross-chain liquidity protocol THORChain to swap assets, a common tactic used to break the "paper trail" across different blockchains.
Volume: In a single hour, over 1,100 ETH was moved and channeled through conversion processes.
A Quick Recap: The Original Exploit
The original attack occurred in late 2025, primarily targeting Balancer V2 Composable Stable Pools. The root cause was a sophisticated exploitation of a rounding-down flaw within the protocol's swap calculation logic. By manipulating the batchSwap function, the attacker was able to drain massive liquidity from the affected pools.
Why Does This Matter Now?
The "resurfacing" of a major hacker after a long hiatus is a critical event for several reasons:
1. Market Sentiment: It serves as a stark reminder of the persistent security risks within DeFi.
2. Selling Pressure: Large-scale movements of stolen ETH into BTC (and potentially into fiat gateways) can create localized selling pressure.
3. Regulatory Scrutiny: Such movements often trigger fresh investigations by cybersecurity agencies and exchange compliance teams (KYC/AML).
Closing Thoughts for the Community
As the attacker continues to move funds, decentralized protocols and centralized exchanges are likely on high alert. For users, this incident highlights the importance of using platforms with robust security measures and staying informed through real-time on-chain alerts.
Stay vigilant, and always do your own research (DYOR).
What do you think about the use of THORChain by hackers ?
#Binance #Balancer #CryptoSecurity #BlockchainNews
$BTC
$ETH
$BNB