Balancer Hack: Insights into the $128 Million Vulnerability and Its Aftermath

A rounding error in the V2 Composable Stable Pools enabled attackers to exploit batch swaps, resulting in a loss of $128 million across seven blockchains.
The Total Value Locked (TVL) dropped by 58%, falling from $443 million to $186 million, leading to a total ecosystem loss of $257 million.
Recovery efforts are underway, with white-hat hackers reclaiming $33 million so far, including $12.8 million via a hard fork from Berachain.
The Balancer attack is recognized as the second-largest DeFi hack of 2025, bringing annual losses in the crypto sphere to over $2.2 billion.

Key Takeaways

A rounding error in the V2 Composable Stable Pools enabled attackers to exploit batch swaps, resulting in a loss of $128 million across seven blockchains.
The Total Value Locked (TVL) dropped by 58%, falling from $443 million to $186 million, leading to a total ecosystem loss of $257 million.
Recovery efforts are underway, with white-hat hackers reclaiming $33 million so far, including $12.8 million via a hard fork from Berachain.
The Balancer attack is recognized as the second-largest DeFi hack of 2025, bringing annual losses in the crypto sphere to over $2.2 billion.

Balancer published a preliminary report on November 5, detailing the exploit that occurred on November 3, 2025. This exploit stemmed from a rounding error in the V2 Composable Stable Pools, allowing attackers to manipulate batch swaps and siphon liquidity through seven different blockchains.

Balancer Hack Insights

Ongoing Recovery Efforts

Thus far, recovery measures have successfully retrieved $33 million. Berachain conducted a hard fork, reclaiming $12.8 million, which has already initiated repayments to affected users. Meanwhile, StakeWise has successfully recovered an additional $20 million.

Balancer commended the “swift actions that mitigated further damage,” highlighting how the team promptly contained the attack and protected the majority of the platform. A detailed post-mortem report, which will specify the steps taken to assist V2 pool users impacted by the hack, is expected soon.

Analyzing the Balancer Attack

The Ethereum network suffered the most significant loss, with attackers draining $99 million. They also targeted pools on Base, Polygon, Arbitrum, Optimism, Sonic, and Avalanche using batch swap manipulations to create discrepancies in pool balances.

Luckily, Balancer intervened quickly, pausing the vulnerable pools shortly after the exploit was detected, which prevented further damages. Notably, the V3 pools remained entirely secure throughout this incident, demonstrating the effectiveness of the protocol's newer infrastructure.

This exploit has now been categorized as the second-largest hack in DeFi for 2025, contributing to a staggering total annual loss exceeding $2.2 billion across the ecosystem.

Impact on TVL and Market Reaction

The most telling aspect of this incident is reflected in the Total Value Locked (TVL) statistics. Balancer's TVL plummeted from $442.96 million on November 3 to a mere $186.09 million today, representing a startling 58% decline within just two days.

Balancer TVL

The TVL chart illustrates a significant drop coinciding with the hack, wiping out months of stability in the $450-$600 million range. Balancer's TVL had already faced a downward trajectory from over $1 billion in January 2025, with the hack accelerating this decline.

Following the exploit, the price of the BAL token fell by 6% but later stabilized as traders began to recognize the durability of V3. The token performed better than the TVL, indicating some market confidence in Balancer’s recovery strategies and migration initiatives.

Balancer is now advocating for a robust migration to V3 and is alerting users against scam messages exploiting the current situation. Additionally, the team is committed to implementing code upgrades and conducting thorough audits to avoid similar vulnerabilities in the future.