Balancer DeFi Protocol Recovers $19.3 Million After Major Hack

The Balancer DeFi protocol recently experienced a significant security breach affecting its V2 Composable Stable Pools, leading to losses that exceeded $128 million. Fortunately, liquid staking platform StakeWise successfully recovered $19.3 million in stolen assets.

Key Takeaways

Balancer suffered a major hacking incident with losses exceeding $128 million.
StakeWise recovered $19.3 million from the hacker, reducing the total stolen amount.
The breach impacted only the V2 Composable Stable Pools, with other Balancer pools remaining safe.
Balancer's total value locked (TVL) halved as a result of the incident, dropping from $442 million to approximately $214 million.

Balancer Hack

The Details of the Balancer Hack

On Monday, the DeFi protocol Balancer faced a serious security breach that targeted its V2 Composable Stable Pools. According to an alert from PeckShield, the total losses across multiple chains were reported to be over $128 million.

Following the attack, on-chain analyst EmberCN provided an update revealing that StakeWise, a liquid staking platform, managed to recover 5,041 osETH, worth about $19.3 million, from the hacker through a specific contract call. EmberCN stated, “The assets stolen by the hacker from Balancer have decreased from $117 million to $98 million,” noting that more than half of the stolen assets were converted to Ethereum (ETH).

Initial Detection of the Attack

Suspicious transfers of Wrapped ETH (WETH), osETH, and staked ETH (wstETH) to a new wallet were first flagged by analysts at Nansen. The hacking incident unfolded over several hours. As indicated by Cyvers Alerts, the hacker started laundering the stolen funds using Tornado Cash and subsequently swapped them for Ethereum, as reported by Lookonchain.

A DeFi researcher on X outlined the advanced sequence of smart contract manipulations involved in the hack. Their detailed analysis pointed out that the hacker exploited improper authorization and callback handling, which allowed them to bypass security measures. This enabled unauthorized swaps and balance manipulations across interconnected pools, allowing the hacker to drain assets in just a few minutes.

By utilizing a critical Ethereum mainnet key, the hacker initiated a series of transactions, ultimately consolidating the funds onto mixers to facilitate laundering.

Once the breach was acknowledged, the Balancer team communicated via X that their engineering and security teams were investigating the issue with utmost urgency. They reassured users that “all other Balancer pools are unaffected,” clarifying that the problem was limited to the V2 Composable Stable Pools and did not impact either Balancer V3 or any other pools.

Notably, one whale user, who had been inactive for three years, reacted to the hack by withdrawing $6.5 million from the platform.

Impact on DeFi Protocol Total Value Locked (TVL)

The ramifications of the hack were significant. What’s more, Balancer’s total value locked (TVL) plummeted from $442 million on November 2 to just $214.52 million within a day, as reported by DeFiLlama data.

DeFi TVL Drop

This incident mirrors a previous attack in September, when the DeFi yield platform Nemo Protocol lost $2.4 million as its TVL fell by 75%, from $6.3 million.