The $116 million exploit targeting decentralized exchange Balancer appears to have been meticulously planned for months, with the attacker employing advanced operational security and Tornado Cash to obscure their tracks, according to new onchain analysis.
Attacker used Tornado Cash to fund operations
Blockchain data reveals that the exploiter funded their account using multiple 0.1 Ether (ETH) deposits from Tornado Cash a move likely aimed at avoiding detection by automated systems.
Conor Grogan, director at Coinbase, said the attacker stored at least 100 ETH within Tornado Cash smart contracts, suggesting possible connections to earlier hacks.
Hacker seems experienced: seeded account via 100 ETH and 0.1 Tornado Cash deposits. No opsec leaks, Grogan noted, adding that such large Tornado deposits are rare and point to professional-level execution.
Following the breach, Balancer offered a 20% white-hat bounty for the return of stolen funds by Wednesday and confirmed that its security team was collaborating with top researchers to conduct a full post-mortem.
Deddy Lavid, co-founder and CEO of blockchain security firm Cyvers, described the exploit as one of the most sophisticated attacks of 2025.
He said the attackers bypassed access control layers to manipulate asset balances directly a failure in operational governance rather than core protocol logic.
Lavid warned that static audits alone are no longer sufficient and called for continuous, real-time monitoring to detect abnormal fund movements before they escalate into full-scale breaches.
Similarities with Lazarus Group’s long-term tactics
The methodical nature of the Balancer exploit draws parallels with the North Korean Lazarus Group, known for spending months preparing cyberattacks.
Data from Chainalysis shows that Lazarus-linked activity dropped sharply after July 2024 a period analysts now believe was used for “regrouping” and target selection ahead of the $1.4 billion Bybit hack.
Lazarus later laundered the stolen Bybit funds through THORChain within just 10 days, in one of the largest crypto heists ever recorded.