jakiro
Deng Tong, Bitcoin Vision
On November 3, 2025, the DeFi protocol Balancer was hacked, resulting in the theft of more than $100 million in digital assets.On November 4, Balancer V2’s combinable stable pool was attacked again.Coincidentally, after the first attack, the Balancer team already pointed out: We are aware of a possible vulnerability in the Balancer v2 pool, and our engineering and security teams are investigating it as a priority.
This article reviews how Balancer was attacked twice in two days, lists various reactions, takes stock of Balancer’s dark history, and explores why Balancer still has a large number of fans despite frequent security incidents.
1. Review of Balancer being attacked twice in two days
Decentralized exchange and automated market maker Balancer was hacked on Monday, with more than $116 million worth of digital assets transferred to a newly created wallet.
“We are aware of a vulnerability that may impact Balancer v2 pools. Our engineering and security teams are investigating with high priority,” the Balancer team posted on the X Forum on Monday. “Additional developments will be shared as more information becomes available.”
Initial on-chain data shows that Balancer was attacked, losing $70.9 million worth of liquid staked Ethereum.Etherscan logs show that Ethereum was transferred to a new wallet in three transactions.
Crypto intelligence platform Nansen said in an
But the assets stolen this time were not just as simple as $70.9 million. The amount stolen continued to grow.The ongoing attack has expanded the amount of stolen funds to more than $116.6 million as of 8:52 a.m. UTC on Monday, according to blockchain data platform Lookonchain.
Balancer once announced on the chain that it is willing to pay 20% of the stolen assets as a white hat reward to recover the assets, which is valid within 48 hours.If the funds are not returned within the next 48 hours, Balancer will continue to work with blockchain forensics experts and law enforcement agencies to identify the perpetrators.”Our partners have a high degree of confidence that you can be identified through access log metadata collected by our infrastructure, which shows connections from a defined set of IP addresses/ASNs and ingress timestamps associated with on-chain transaction activity,” Balancer noted.
Later, Balancer tweeted: We have noticed a possible vulnerability in the Balancer v2 pool.Our engineering and security teams are investigating as a priority.We will share verified updates and next steps as soon as more information becomes available.
It rained all night. This morning, Balancer was attacked again. This time it was the Balancer V2 composable stable pool that was mentioned yesterday that may have vulnerabilities.
Balancer issued a statement on theSince these pools have been running on-chain for years, many of them have exceeded the time window in which they can be paused.All pools that are currently still available for suspension have been suspended and are in recovery mode.Other Balancer fund pools are not affected.This problem is limited to the V2 composable stable pool and does not affect Balancer V3 or other types of fund pools.Security reminder: There are currently some scam messages on the Internet pretending to be the Balancer security team, but these are not sent by us.Please do not interact with such information from unknown sources or click on any unknown links.”
According to on-chain analyst Ember Monitoring, StakeWise recovered 5,041 osETH ($19.3 million) from the Balancer hacker through contract calls early this morning.As a result, the assets stolen by hackers from Balancer dropped from $117 million to $98 million.Hackers have successively exchanged LST for ETH, and so far more than half of the stolen assets have been exchanged for ETH.
2. Analysis of reasons for theft
Balancer suffered an accounting breach.Trading Strategy, Nansen, and Phalcon explained this attack from different angles.
Mikko Ohtamaa, CEO and co-founder of Trading Strategy, noted that preliminary analysis suggests that a flaw in smart contract checking may be the root cause.
Nicolai Sondergaard, a research analyst at Nansen, said the attacker may have “faked a large fee and deposited it into Balancer’s expense account, then clicked the withdraw button to convert the WETH into cash, essentially converting the fake points into real money.”
Preliminary forensic results from blockchain security firm Phalcon indicate that the attackers were targeting Balancer Pool Tokens (BPT), which represent a user’s share of a liquidity pool.According to the company, the vulnerability stems from the way Balancer calculates pool prices during batch redemptions.By manipulating this logic, the attacker distorted internal price information and artificially created price imbalances, thereby withdrawing tokens before the system could repair itself.
Cryptocurrency analyst Adi noted: “Improper authorization and callback handling enable attackers to bypass security measures. This allows attackers to conduct unauthorized fund exchanges or balance manipulations in interconnected fund pools, thereby depleting assets in a short period of time (minutes).”
Coinbase’s Conor Grogan pointed out that the attacker’s methods showed professionalism: the attacker’s address was originally funded by 100 ETH provided by Tornado Cash, which means that the funds are likely to come from previous exploits.“People don’t usually deposit 100 ETH into Tornado Cash just for fun,” said an experienced hacker.
3. Balancer was attacked. How did all parties react?
1. The crypto market has plummeted
Affected by the theft of Balancer and the selling pressure of nearly $100 million in stolen assets from hackers, the entire crypto market is not very optimistic, and SOL’s 24-hour drop is even close to 10%.As of press time, BTC was trading at $104,577, down 2.6% in 24 hours; ETH was at $3,506, down 5.6% in 24 hours.
BAL, the native governance token of the Balancer protocol, even recorded a double-digit decline.As of press time, BAL was trading at $0.8376, a 24-hour drop of 12.6%.
2. The Balancer fork project is affected
Redstone co-founder Marcin tweeted a reminder: Balancer’s forked projects, such as Beets on Sonic, also seemed to be affected. According to DefILlama data, BEX TVL quickly dropped from $54 million to about $41 million in just over an hour, a drop of more than 24%.In addition, BEX on Berachain may also be affected. Beets TVL is about 10 million US dollars, with a drop of more than 30% in half an hour.
Sonic officially issued a statement onIn addition, two wallets related to the hacker (0xf19f, 0x0453) have been frozen pending further investigation.Sonic will work with the Beets team to advance follow-up work.
The Berachain Foundation stated that validator nodes have coordinated to suspend the operation of the Berachain network to allow the core team to perform an emergency hard fork to resolve the vulnerability issue related to Balancer V2 on BEX.This network suspension is planned and the network will resume operation shortly.
GoPlus also posted on social media that all Fork Balancer’s DeFi projects are affected by this vulnerability, and multiple protocols have been attacked.It is recommended to check the Balancer fork protocol list on the Defillama website, stop interacting with it immediately, and withdraw assets in time to protect yourself.
3.Lido has exited its unaffected Balancer position
Lido issued a statement stating that some BalancerV2 pools have been attacked.The Lido protocol is not affected and all user funds are safe.Out of an abundance of caution, Lido GGV’s management team Veda has exited its unaffected Balancer positions.All Lido Earn funds remain safe.
4. Whale withdraws funds
Affected by the hacker attack, the giant whale 0x0090 just woke up after the Balancer attack after being dormant for 3 years – and urgently withdrew all 6.5 million US dollars in funds from Balancer.
5. Netizens’ reactions
Content creator PythiaCrypto points out: From a legal and security perspective, what else can be done?The only way is to find the stolen funds, freeze them and then return the money to the person who stole it.If this is not possible, then there is really no way to hold the person who stole the money accountable or compensate the victim.
Some netizens were indignant:
“This is one of the most potentially exploitable vulnerabilities in history.”
“After losing 116 million, still saying it has “potential” is simply crazy.”
“XMR to receive $110 million in capital injection.”
“From Cetus Protocol to Nemo Finance and now Balancer Finance? All this happened in the same year! Should we be worried about using decentralized finance? This is the ‘future of finance’, right?”
4. Still stolen after eleven audits. InventoryBalancer’s dark history
How many audits has Balancer undergone?11 times.
Suhail Kakar, head of blockchain developer relations at TAC, said, “Balancer has been audited more than a dozen times, and the vault has been audited three times by different companies, but it was still hacked, with losses of up to $110 million. The field needs to understand that ‘audited by X’ means almost nothing. Code is hard, DeFi is even harder.”
According to the Balancer V2 audit list available on GitHub, four different security firms — OpenZeppelin, Trail of Bits, Certora, and ABDK — have conducted 11 audits of the platform’s smart contracts, with the most recent being an audit of its stable pool by Trail of Bits in September 2022.
Cryptocurrency analyst Antyzo points out: Cutting corners on security audits is always counterproductive.I hope user funds are safe.Auditing is a basic necessity for any DeFi protocol, not an optional expense.
Rei Soleil, co-founder of UntradenOrg, pointed out: The silence of auditors is deafening.
PegaX co-founder Neighman pointed out: Balancer has gone through multiple audits and set up a $1 million bug bounty, but it still faces this disaster.In this field, safety can never be underestimated, it is the most basic requirement.The same is true for on-chain trading platforms.
Balancer has long been viewed as the conservative choice of liquidity provider, a place to park your assets and earn stable returns.Its long history, strict audit system, and integration with major mainstream DeFi platforms have created the illusion that long-term operation is equivalent to security.However, yesterday’s and today’s security breaches undermine this narrative.
Balancer has suffered multiple hacker attacks before.
In June 2020, Balancer suffered a deflation token vulnerability attack and lost US$520,000.The attacker exploited a vulnerability in the Balancer protocol’s mishandling of deflationary tokens, borrowed 104,000 ETH from the dYdX flash loan, and then repeatedly traded between STA and ETH 24 times.Because Balancer did not correctly calculate the actual balance after each transfer, the STA in the pool was eventually exhausted to only 1wei. The attacker took advantage of the serious price imbalance and exchanged a small amount of STA for a large amount of ETH, WBTC, LINK, and SNX.
In March 2023, Balancer was implicated in the Euler incident and suffered a loss of US$11.9 million.Euler Finance suffered a $197 million flash loan attack. Balancer’s bb-e-USD pool was implicated for holding Euler’s eTokens. About $11.9 million was transferred from Balancer’s bb-e-USD pool to Euler, accounting for 65% of the pool’s TVL.
In August 2023, the Balancer V2 pool was attacked by an accuracy vulnerability, resulting in a loss of US$2.1 million.The attacker biased the supply calculation of BPT (Balancer Pool Token) through precise manipulation, thereby withdrawing the assets in the pool at an unfair exchange rate.The attack was accomplished through multiple flash loan transactions.
In September 2023, Balancer was attacked by DNS hijacking, causing a loss of US$240,000.Hackers used social engineering methods to break into the domain name registrar EuroDNS and hijack the balancer.fi domain name. Users were redirected to a phishing website, which used the Angel Drainer malicious contract to trick users into authorizing transfers. The attackers then laundered the stolen money through Tornado Cash.
In June 2024, Balancer was implicated in the Velocore hack and suffered a loss of US$6.8 million.The attacker exploited an overflow vulnerability in Velocore’s Balancer-style CPMM pool contract and stole approximately $6.8 million by manipulating the fee multiplier to exceed 100%, causing a calculation error and ultimately using a flash loan combined with a carefully crafted withdrawal operation.
5. Why are there still loyal fans despite being frequently stolen?
Even though Balancer has frequently exposed security incidents since its launch in 2020, there are still many users who are loyal fans.
The fundamental reason is that Balancer is not only a decentralized exchange, but also an AMM automatic market maker, supporting multi-asset pools, programmable weights, dynamic rates, Boosted combination pools, etc.Many DeFi projects and strategies (such as Yearn, Aura, BeethovenX, etc.) directly rely on the Balancer protocol as the underlying liquidity layer.Therefore, even if there are security incidents, the inertia of these upper-layer protocol ecosystems still maintains the user base.
Secondly, since Balancer is an AMM protocol, it allows users to create and manage customized liquidity pools, supporting a combination of multiple assets and different weight settings.This has attracted many professional liquidity providers and traders, who can optimize liquidity allocation according to their own strategies to obtain higher returns.And Balancer’s algorithm can utilize liquidity more effectively. Compared with traditional AMM, it can provide better transaction prices and lower slippage under the same liquidity.This is very important for users with large transactions and frequent transactions, and can reduce their transaction costs.
6. Can you still trust DeFi?
Hasu, strategic director of Flashbots and strategic consultant of Lido, said that Balancer v2 was launched in 2021 and has since become one of the most watched and frequently forked smart contracts.This is very worrying.Every time a contract that has been online for so long is attacked, it (rightly so) sets back DeFi adoption by 6 to 12 months.
Harry Donnelly, founder and CEO of Circuit, called Balancer’s data breach a “serious warning” to the DeFi ecosystem, noting that Balancer is “one of the most trusted names in the space” and an “early pioneer with a compliance culture, backed by rigorous auditing and public disclosure.”It’s this transparency that has helped Balancer succeed, but it also makes it more vulnerable to attack.“If DeFi wants to truly challenge traditional finance, it must stay ahead of bad actors through proactive resilience and response, not just reactive patching of vulnerabilities and freezing funds.”
OneSource founder and CEO Vladislav Ginzburg said: “Smart contracts and financial engineering are part of the risk of DeFi investment. Therefore, smart contract audits are critical. I do not believe that the Balancer vulnerability represents a new paradigm and therefore should not change trust or risk factors. The status quo remains unchanged.”
Kadan Stadelmann, chief technology officer of the Komodo platform, also expressed a similar view. He believes that core DeFi users will not be deterred by this, but institutional investors may be affected.“It is these types of hacks in the DeFi space that cause institutional investors and alternative asset investors to switch to pure Bitcoin strategies.”
