DeFi Protocol Balancer Starts Recovering Funds Stolen in $128 Million Heist

Hackers drained more cryptocurrency from the DeFi protocol Balancer in a $128 million heist by exploiting a rounding flaw in the upscale function of EXACT_OUT transactions and using batch swaps to manipulate pool balances. The attack occurred at 7:48 AM UTC, affecting Balancer V2 composable stable pools and pools on Ethereum, Base, Avalanche, Gnosis, Berachain, Polygon, Sonic, Arbitrum, and Optimism, with some pools live on the blockchain for years and therefore not pausable.

Balancer said that any pools that could be paused have been paused and are now in recovery mode, while all other Balancer pools remain unaffected. Initial estimates had the drain at roughly $128 million, but rapid community response reduced total losses by more than $20 million. Balancer explains that attackers were able to bypass the minimum pool supply limit by treating LP receipt-tokens as regular tokens, and that the funds often remained within the Vault as internal balances before being withdrawn later.

The protocol is continuing its investigation and will publish a comprehensive post-mortem once partner verification and reconciliation are complete, according to Balancer.