The hack works like this:
[ethBlock cid, 'state/<address>/balance']
would first resolve to
[<ethBlock.stateRoot cid>, '/<hash of address>:eth-account/balance']