Balancer Shares Details of $116M Hack in First Report

Balancer Reveals $116 Million Hack Details in First Post-Attack Report

Written by Aaron S.,

Editor-In-Chief

Last Updated: November 06, 2025

Key Takeaways

Balancer lost $116 million in a November 3 exploit targeting two pool types; the issue involved flawed rounding logic in token swap calculations;
The attacker used flash loans and BatchSwaps to manipulate rounding outcomes and drain funds from the Stable and Composable pools;
Balancer paused affected pools, blocked new ones, and recovered about $21 million in assets by working with security and protocol partners.

Stop overpaying - start transferring money with Ogvio. Join the waitlist & grab early Rewards NOW! 🎁

BITDEGREE IN YOUR SOCIAL FEED

The team behind the Balancer protocol has released its first update following a security breach that led to losses of around $116 million.

The report outlines how the incident occurred and the steps taken so far.

The attack happened on November 3 and affected two specific pool types within Balancer: v2 Stable Pools and Composable Stable v5 Pools.

What is FUD in Crypto? (Fear, Uncertainty & Doubt Explained)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

According to the team, the attacker used a combination of transaction bundling, called BatchSwaps, and flash loans, which are short-term loans taken and repaid in a single transaction. The exploit relied on a flaw in the system’s rounding mechanism, used in certain types of token swaps.

Normally, this function rounds values downward, but the attacker was able to influence how rounding worked in their favor.

By combining the rounding flaw with the bundled transactions, the attacker was able to extract funds from the targeted pools. Balancer noted that, in many cases, the stolen assets were first held in the platform's internal balance system before being moved out in later transactions.

Following the attack, Balancer worked with other blockchain security groups and protocol teams to recover or freeze some of the stolen assets. This included recovering about $19 million worth of StakeWise Staked ETH (osETH) and around $2 million in osGNO tokens.

To prevent further damage, Balancer has paused all affected pools and has temporarily stopped users from creating new pools of the same type.

A recent cyberattack targeting Seedify, a platform supporting Web3 gaming projects, resulted in the theft of around $1.2 million. How? Read the full story.