According to @EmberCN, the address linked to the Balancer exploit swapped ETH LST tokens and other non-ETH assets into ETH, then deposited 2,000 ETH (about $6.36 million) into Tornado Cash within the past hour; this activity is visible on-chain. source: x.com/EmberCN/status/1989550291327525232, source: etherscan.io/address/0x0e9c9473d0c504da72763426719f6f03a15544d5 On-chain records for 0x0e9c9473d0c504da72763426719f6f03a15544d5 show multiple deposits to Tornado Cash contracts totaling 2,000 ETH in a one-hour window, indicating active obfuscation of funds. source: etherscan.io/address/0x0e9c9473d0c504da72763426719f6f03a15544d5 @EmberCN adds that moving the stolen ETH through Tornado Cash likely signals the actor is not pursuing a white-hat bounty pathway that would involve returning funds. source: x.com/EmberCN/status/1989550291327525232 For traders, Tornado Cash usage aligns with patterns seen in crypto hacks where mixers are used to launder stolen assets, complicating tracing and recovery; this typically heightens risk perception for related tokens and pools. source: home.treasury.gov/news/press-releases/jy0916, source: blog.chainalysis.com/reports/crypto-crime-mid-year-update-2022-mixers Monitor BAL, Balancer-related pools, and further outflows from the flagged address for potential liquidity shifts and on-chain sell pressure signals tied to the exploit. source: x.com/EmberCN/status/1989550291327525232, source: etherscan.io/address/0x0e9c9473d0c504da72763426719f6f03a15544d5

According to @EmberCN, the Balancer exploiter has been swapping ETH LST and other non-ETH tokens into ETH over recent days, as tracked via Arkham Intel (source: https://x.com/EmberCN/status/1987855363744686530, source: https://intel.arkm.com/explorer/entity/a1143094-5699-4e4a-a5ae-bca37094202c). The address now holds 25,300 ETH valued around $91.69M, indicating a near-complete rotation into ETH at the tagged entity, which concentrates on-chain liquidity in a single asset relevant to ETH market monitoring (source: https://x.com/EmberCN/status/1987855363744686530, source: https://intel.arkm.com/explorer/entity/a1143094-5699-4e4a-a5ae-bca37094202c).

According to @EmberCN, a hacker stole about 117 million dollars from Balancer across Ethereum, Base, OP, Sonic, Polygon, and Berachain, with most of the haul being ETH liquid staking tokens. According to @EmberCN, the attacker has begun converting liquid staking tokens to ETH, including a swap of 10 osETH for 10.55 ETH roughly 20 minutes before the post. According to the ARKM entity page shared by @EmberCN at https://intel.arkm.com/explorer/entity/a1143094-5699-4e4a-a5ae-bca37094202c, a set of suspected attacker addresses is available for monitoring. According to @EmberCN, traders can track on-chain flows from the ARKM listed addresses to manage execution and liquidity risk on ETH LST pairs across the affected chains.