$116 Million in Crypto Assets Lost: Balancer Faces a Major DeFi Exploit

Over $116 million in cryptocurrency assets have been stolen from the Balancer Protocol, marking one of the most significant decentralized finance (DeFi) exploits in 2025.

Key Takeaways

Massive Exploit: Over $116 million in cryptocurrencies were stolen from the Balancer Protocol, one of the largest exploits in DeFi history.
Ongoing Alerts: Major protocols like Lido and Aave reported their security statuses and reassured users that their funds remain safe.
Investigation Underway: Developers have acknowledged the exploit but are still uncovering details about how it occurred and the extent of the losses.
Security Concerns: The incident underscores ongoing vulnerabilities in DeFi platforms, highlighting an increase in cyberattacks across multiple blockchains.

At around 9:12 AM on Monday, blockchain analytics company Lookonchain alerted the community, indicating that Balancer was exploited for $70.6 million in crypto.

Initial investigations revealed that the attacker took 6,587 WETH (worth approximately $24.46 million), 6,851 osETH (valued at $26.86 million), and 4,260 wstETH (around $19.27 million) from various blockchains.

Timeline of the Balancer Exploit

Shortly after, Lookonchain updated its report within thirty minutes, confirming that the total amount stolen had surpassed $116 million.

The meticulous nature of this exploit suggests that it was part of a well-organized and technically advanced operation that crossed multiple DeFi platforms.

As of the latest information, on-chain data indicates the hacker’s DeBank portfolio holds about $95 million, with approximately $21 million having been shifted to different wallets—likely attempts to conceal and liquidate the stolen funds.

Balancer Exploit

This incident has also triggered significant reactions among Balancer-forked projects, as many associated protocols reported security breaches or enacted preventive measures.

In response to the news of this attack, panic withdrawals commenced, notably from a previously inactive whale wallet (0x0090), which made a sudden withdrawal of $6.5 million from Balancer pools.

Response from Major DeFi Protocols

Prominent Ethereum-based protocols have quickly responded to the situation.

Lido, a leading platform for liquid staking, confirmed that some Balancer V2 pools were affected. However, they assured users that Lido's core protocol and user funds remain secure.

In an official statement, Lido indicated:

“Out of an abundance of caution, the Veda team — curators of Lido GGV — has withdrawn its unaffected Balancer position.”

Meanwhile, Aave, a major DeFi lending platform, affirmed its complete immunity to the attack.

Aave explained that its Aave/stETH stkBPT pool utilizes a custom version of Balancer V2, which operates outside the vulnerable aspects of Balancer.

“The Aave protocol has no dependencies on Balancer V2 and is unaffected to the best of our knowledge,” the Aave team stated.

Ongoing Investigation and It’s Implications

While Balancer developers have acknowledged the exploit, they have not disclosed the underlying cause or the total extent of the losses.

However, preliminary indications point to a complex cross-chain exploit potentially targeting the unique liquidity architecture of the protocol.

This is not the first time Balancer has faced challenges with security. In August 2023, the protocol experienced a $2 million loss due to a code vulnerability, which was followed by an additional drain of over $900,000 from its V2 pool.

Just like the recent exploit, these vulnerabilities were present across several networks including Ethereum, Polygon, Arbitrum, Optimism, Avalanche, Gnosis, Fantom, and zkEVM.

Increasing Security Concerns in DeFi

This recent exploit highlights an alarming trend of growing security issues impacting numerous major chains, extending beyond just Ethereum.

On September 8, the Nemo Protocol—a DeFi yield platform operating on the Sui blockchain—suffered a cyberattack that resulted in losses totaling $2.4 million just before its scheduled maintenance.

On the same day, Swiss crypto platform SwissBorg reported the loss of $41.5 million worth of Solana (SOL) tokens due to a hack on its partner API provider, Kiln.

In May, reports surfaced indicating that Cetus Protocol, a decentralized exchange built on the Sui blockchain, was exploited, resulting in the loss of more than $200 million.

According to PeckShield’s latest report, crypto hacks led to $127.06 million in losses just in September 2025, emphasizing the persistent risk of large-scale attacks on DeFi and blockchain platforms.

In the first half of 2025 alone, crypto exploits amounted to $2.1 billion, nearing the total losses of the entire year of 2024.

Why Do Crypto Hacks Continue?

In an August interview with Cryptonews, Mitchell Amador, founder and CEO of Immunefi, mentioned that most crypto hacks occur due to three main factors:

Static audits: Businesses often rely on one-time assessments, overlooking flaws that may arise post-launch in evolving smart contracts.
Ignoring incentives: They underestimate the appeal of Web3’s open-ledger system, which necessitates bounty systems to outbid attackers.
Lack of Web3 expertise: Many teams possess inadequate blockchain knowledge, leading to unrecognized composability or oracle risks.