Hackers have been silent for 5 months and suddenly struck! 51 million ETH still in their hands, is the real risk just beginning? On-chain monitoring shows that the Balancer attacker, who has been silent for 5 months, is active again: approximately 100 ETH (about $233k) has been transferred to a new address, and further dispersed transfers are underway through Tornado Cash. But the more critical data is: the attacker still holds about 21,900 ETH, worth approximately $51.13 million. Many people, upon seeing this, will only focus on "they moved again." But from the perspective of market makers, the focus of such events has never been "small transfers," but whether the stockpile structure is beginning to loosen. Why? Because hackers or attackers' fund behaviors usually follow three steps: first testing transfer paths (small exploratory transfers), then dispersing funds (reducing traceability risk), and finally gradually exiting the system (liquidity realization). The 100 ETH seen now is more like—first step "exploratory action."