Berachain Implements Emergency Hard Fork to Halt Hacker Following Balancer V2 Breach

Berachain's Emergency Hard Fork Traps Hacker, Freezing Funds From Balancer V2 Exploit

In response to a significant security breach involving the Balancer V2 Composable Stable Pools, Berachain has initiated an emergency hard fork to trap the hacker’s funds, which were a part of the $128 million that was stolen. This proactive measure seeks to contain the repercussions of the attack and facilitate the return of the assets.

Key Takeaways

Berachain conducted an emergency hard fork to lock down funds related to a hacker after the Balancer V2 exploit.
The breach resulted in the theft of over $128 million across multiple chains.
An identified white-hat operator has agreed to return the compromised assets.
The exploit underscores ongoing vulnerabilities in the DeFi sector, even after multiple security audits.

Berachain Takes Action Following Balancer Security Breach

Berachain has executed an emergency hard fork to trap the hacker’s funds following a major breach of the decentralized finance (DeFi) protocol Balancer, resulting in the loss of over $128 million from its V2 Composable Stable Pools. This action aims to contain the fallout from the recent attack, freezing funds associated with the intruder and facilitating the recovery of assets through a self-identified white-hat operator.

In a communication shared on X, the Bera Foundation confirmed that the binary for the hard fork has been distributed, and many validators have already completed their upgrades. Meanwhile, the chain's operations are temporarily paused as the core team collaborates with various infrastructure partners to ensure a stable restart.

“Before we go live and start producing new blocks again, we aim to confirm that crucial infrastructure partners—such as oracles for liquidations—have updated their RPCs,” stated the team.

They also mentioned that bridges, centralized exchanges, and custodians will be reinstated once the chain resumes its activities.

Background on the Balancer V2 Exploit

The exploit that triggered Berachain's emergency response primarily targeted Balancer V2 Composable Stable Pools, draining more than $128 million across several blockchains. The security firm PeckShield was one of the first to alert the community about this incident, identifying it as one of the largest DeFi exploits occurring this year.

Over the course of several hours, the hacker took advantage of a vulnerability in Balancer's smart contracts, specifically within the authorization logic. Analysts from Defimon Alerts and Decurity later pinpointed the flaw in the manageUserBalance function, which failed to properly verify user permissions. By exploiting this error, the hacker was able to impersonate other users and withdraw internal balances without proper authorization.

On-chain analytics from Nansen revealed suspicious transfers of wrapped Ether (WETH), osETH, and wstETH to a new wallet, followed by extensive conversions into Ethereum. Following the attack, Cyvers Alerts noted that the hacker began laundering the stolen funds through Tornado Cash.

While investigations were ongoing, on-chain analyst EmberCN reported that the liquid staking protocol StakeWise successfully retrieved 5,041 osETH, valued at about $19.3 million, through a contract call. This recovery reduced the total amount stolen to approximately $98 million, with over half of it already converted to ETH.

Balancer's Ongoing Security Struggles

In a bid to avert further losses, Berachain's swift response was crucial as it became one of the impacted ecosystems from the breach. According to the foundation, an MEV bot operator—who has been active on Berachain for several months—currently holds the compromised funds and has consented to their return.

The operator claimed to be a white hat and expressed willingness to pre-sign transactions for the return of the funds as soon as the chain is operational again. Berachain confirmed the funds would be restored to the deployer address 0xD276D…, with on-chain messages sent to verify the process.

This situation has escalated scrutiny concerning DeFi security. Despite having undergone more than ten audits from prominent firms such as OpenZeppelin, Trail of Bits, and Certora, Balancer's V2 contracts remained vulnerable to exploitation.

Developer Suhail Kakar highlighted that repeated audits do not guarantee safety, stating, “code is hard, DeFi is harder.” This incident adds to Balancer's troubled security record, as the protocol has faced several attacks since its launch in 2020, including a loss of $520,000 due to a deflationary token vulnerability in 2020, a $2.1 million rounding error exploit in 2023, and a DNS hijack later that same year.

According to DeFiLlama data, Balancer's total value locked has dropped drastically from $442 million to approximately $213 million within just a day.