How a Tiny Rounding Error Led to a $128 Million DeFi Exploit on Balancer

A small rounding error embedded within Balancer's smart contracts has resulted in one of the largest decentralized finance (DeFi) hacks in 2025, with more than $128 million siphoned from its Composable Stable Pools (CSPs) across various blockchains.

Key Takeaways

A rounding error in Balancer's smart contracts triggered a $128 million exploit.
The attack primarily targeted V2 Composable Stable Pools, while V3 and other pool types remained safe.
Balancer's response included activating an emergency war room and utilizing its Safe Harbor framework for fund recovery.
While robust security measures were in place, the incident underscores ongoing vulnerabilities in DeFi.

How a Tiny Rounding Error Ignited Balancer’s $128M Multi-Chain DeFi Exploit

The incident was initiated on November 3 at 07:46 UTC and was first caught by Hypernative’s monitoring system.

Shortly after, Balancer confirmed an ongoing attack targeting its V2 Composable Stable Pools across multiple networks such as Ethereum, Base, Arbitrum, Avalanche, Optimism, Gnosis, Polygon, Berachain, and Sonic.

It's important to note that other Balancer pool types and the V3 protocol were unaffected.

What Went Wrong Despite Balancer’s Ten Audits?

According to Balancer's initial findings, the exploit arose from a minor yet crucial rounding error in the "upscale" function utilized during batch swaps, which allows for multiple token swaps within a single transaction.

The issue was specifically in the code that managed “EXACT_OUT” swaps, where non-integer scaling factors led to incorrect rounding, enabling attackers to manipulate pool balances and rapidly extract funds.

Balancer reported that the attack was limited to V2 Composable Stable Pools and their derivatives, such as BEX and Beets.

Preliminary evaluations indicated that the impacted contracts were largely those with expired pause windows. Meanwhile, newer CSPv6 pools were swiftly paused by Hypernative’s emergency protocols shortly after detection.

Blockchain security firm PeckShield estimated the total losses to exceed $128 million, though Balancer mentioned that verified figures are still pending. Stolen assets, including ETH, osETH, and wstETH, were quickly transferred and partially laundered through Tornado Cash.

In response, Balancer activated its emergency war room, collaborating with partners, ethical hackers, and security professionals to mitigate the attack.

Thanks to Balancer's Safe Harbor framework (BIP-726), enacted in 2024, ethical hackers could legally step in and assist in recovering funds. Early recovery efforts resulted in $19 million in osETH and $1.7 million in osGNO being retrieved by the StakeWise DAO.

Other initiatives across the DeFi space helped limit losses, with the Berachain Foundation implementing an emergency hard fork to contain the stolen assets after agreeing with an MEV bot operator to return them.

Sonic Labs froze the attackers' wallets, while both Gnosis and Monerium stopped around €1.3 million in EURe stablecoins to prevent further movement across chains. Ethical hacking groups like BitFinding and Base MEV bots helped recover an additional $750,000.

In its most recent update, Balancer indicated it had shut down the CSPv6 factory to halt new pool creation, paused liquidity gauges for the affected pools to stop emissions, and initiated recovery-mode withdrawals for liquidity providers.

Users with stakes in paused pools can now withdraw their underlying tokens in proportion to their holdings.

Balancer stressed that its V3 pools and non-stable V2 pools remain unaffected and continue to operate normally.

Balancer’s Breach Linked to Known Rounding Vulnerabilities; TVL Drops Over 50%

The breach occurred despite Balancer's established reputation for strong security. As one of DeFi's earliest automated market makers, it has undergone more than ten audits by renowned companies such as OpenZeppelin, Trail of Bits, and Certora.

However, this latest incident mirrors a prior rounding-related vulnerability identified in 2023—similar to the type of flaw exploited in this much larger hack.

Balancer has faced several security challenges in the past, including a $520,000 loss in 2020, a $2.1 million rounding exploit in 2023, and a DNS hijacking incident later that year.

After the exploit, Balancer’s total value locked (TVL) plummeted from $442 million on November 2 to just over $214 million within 24 hours; it has since decreased to $182 million, according to DeFiLlama.

TVL Drop Impact

The fallout from the breach reverberated throughout the DeFi ecosystem, prompting a significant whale wallet to withdraw $6.5 million soon after the attack.