The Balancer attacker has been traced back to the Ethereum address 0x86fEdAd11C4765700934639f1EFE1fc01355C982, which withdrew 0.1 and 100 ETH from Tornado Cash two days ago. This suggests the attacker had substantial funds even before the attack, and now possesses even more.