Checkpoint Analysis: Dissecting the $128M Balancer Pool Drain in Under 30 Minutes

In the early hours of 3 November 2025, the Balancer V2 Vault was identified as the focus of a rapid DeFi heist, with attackers siphoning $128.64 million from Balancer ComposableStablePool contracts across six networks in under 30 minutes, according to Check Point Research’s blockchain threat monitoring systems.

The breach exploited a precision-loss in Balancer’s arithmetic, centred on the upscale Array function, where micro-swaps pushed prices downward and allowed the attacker to redeem undervalued Balancer Pool Tokens for the full underlying value. The operation was automated via a contract whose constructor executed over 65 batched swap cycles, accumulating stolen funds in the Vault balance before a later withdrawal moved assets to the attacker’s recipient address.

Blockchain analysis linked the exploit to specific contracts and addresses: the Exploit Deployer, the Attacker Contract, and the Final Recipient, with WETH, osETH, and wstETH involved in the extraction. The incident underscores how small arithmetic edge cases, combined with adversarial automation, can trigger multi-network losses and challenge secure DeFi protocol design.