A wallet linked to the Balancer V2 exploit converted 21,000 ETH into 617.43 BTC over three days, marking renewed movement from dormant funds tied to one of DeFi’s notable security incidents.
TLDR KEY POINTS
- A Balancer V2 exploiter swapped 21,000 ETH into 617.43 BTC over three days.
- The conversion used a multi-day execution strategy rather than a single transaction.
- The wallets had been dormant since the original exploit, and the attacker reportedly retained around 1,000 ETH.
What happened in the Balancer exploiter’s ETH-to-BTC swap?
Wallets tied to a Balancer V2 exploit began moving funds that had remained idle since the original attack. On-chain trackers flagged the activity as the exploiter converted 21,000 ETH into 617.43 BTC across multiple transactions spanning three days.
The multi-day execution suggests a deliberate approach to liquidating the ETH position rather than a single large market sell. The exploiter reportedly retained approximately 1,000 ETH after completing the series of swaps.
Balancer’s governance forum had previously addressed these dormant exploit wallets. A recovery assistance proposal (BIP-908) specifically referenced the 21,000 ETH sitting in the attacker’s wallets, highlighting community efforts to recover the stolen funds before any movement occurred.
Why does the ETH-to-BTC rotation matter?
Converting a large ETH position into BTC fundamentally changes the asset exposure of the stolen funds. Bitcoin’s deeper liquidity and broader acceptance across exchanges could make the funds harder to freeze compared to holding a concentrated ERC-20 position.
The three-day execution window is notable. Spreading the conversion across multiple days and likely multiple venues reduces the immediate price impact on either asset, a pattern consistent with how large holders manage significant position changes, whether they are institutions involved in large-scale Bitcoin mining operations or threat actors moving illicit funds.
A separate Balancer governance proposal, BIP-892, had addressed the distribution of funds successfully rescued from the November 2025 attacks, indicating that the community had already been working through recovery channels before this latest wallet movement.
What should on-chain watchers monitor next?
The primary question now is whether the 617.43 BTC will remain consolidated or be distributed across additional wallets. Redistribution into smaller amounts across multiple addresses is a common pattern for exploiters attempting to obscure the trail of stolen funds.
The retained ETH balance, reportedly around 1,000 ETH, also warrants monitoring. Any movement from that remaining position could indicate the next phase of the exploiter’s strategy, and regulators around the world have been tightening oversight of cross-chain fund movements tied to exploits.
On-chain analysts tracking these wallets should watch for BTC transfers to mixing services, cross-chain bridges, or exchanges with weaker KYC requirements. Protocols exploring new DeFi staking mechanisms and other on-chain activity could also be affected if the exploiter attempts to re-enter decentralized protocols. Without new wallet activity, further conclusions about the exploiter’s intentions remain speculative.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.