{"id":90732,"date":"2025-11-06T16:42:23","date_gmt":"2025-11-06T13:42:23","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=90732"},"modified":"2025-11-06T16:45:26","modified_gmt":"2025-11-06T13:45:26","slug":"balancer-team-identifies-cause-of-128-million-hack","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/balancer-team-identifies-cause-of-128-million-hack\/","title":{"rendered":"Balancer Team Identifies Cause of $128 Million Hack"},"content":{"rendered":"<p>The hack on the <a href=\"https:\/\/forklog.com\/en\/news\/what-is-decentralised-finance-defi\">DeFi<\/a> protocol Balancer was attributed to a flaw in one of the platform&#8217;s key components\u2014the Composable Stable pools. This conclusion was shared by the project&#8217;s developers.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zxx\" dir=\"ltr\"><a href=\"https:\/\/t.co\/a1cyWETmhC\">https:\/\/t.co\/a1cyWETmhC<\/a><\/p>\n<p>\u2014 Balancer (@Balancer) <a href=\"https:\/\/twitter.com\/Balancer\/status\/1986104426667401241?ref_src=twsrc%5Etfw\">November 5, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to the statement, the vulnerability allowed attackers to exploit a feature of the deferred settlement mechanism. Due to a coding error, liquidity could temporarily fall below the critical minimum threshold.<\/p>\n<p>In certain swap operations (EXACT_OUT), non-integer scaling factors led to rounding down values. These discrepancies accumulated, creating an opportunity to manipulate pool balances, enabling hackers to withdraw funds.<\/p>\n<p>Assets were initially moved to internal accounts of Balancer v2 storage and then withdrawn through separate transactions.<\/p>\n<p>The main impact was on Composable Stable v5 pools, whose protective period had expired. The v6 pools avoided extensive depletion thanks to the Hypernative emergency response system, which automatically suspended their operation.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cThe incident exclusively affected Composable Stable Pools in Balancer v2 and their forks in other networks: BEX and Beets. Balancer v3 and other pool types were not attacked,\u201d noted the protocol team.<\/em><\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">Scale of the Incident<\/h2>\n<p>To counter the threat, other Balancer partners also took various measures. Specifically:<\/p>\n<ul class=\"wp-block-list\">\n<li>StakeWise DAO <a href=\"https:\/\/x.com\/stakewise_io\/status\/1985462161670336944\">returned<\/a> about $19 million in osETH and $1.7 million in osGNO\u201473.5% of the stolen osETH volume;<\/li>\n<li>Berachain validators <a href=\"https:\/\/forklog.com\/en\/news\/berachain-executes-emergency-hard-fork-following-128-million-balancer-breach\">halted<\/a> the network for a <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-hard-fork\">hard fork<\/a> that addressed the vulnerability in BEX v2;<\/li>\n<li>Sonic Labs <a href=\"https:\/\/x.com\/SonicLabs\/status\/1985401737096671549\">froze<\/a> wallets linked to the suspected attacker and blocked fund movements in its Balancer fork;<\/li>\n<li>Gnosis <a href=\"https:\/\/x.com\/gnosisdotio\/status\/1985321081255891396\">imposed<\/a> temporary restrictions on bridge operations;<\/li>\n<li>Monerium froze 1.3 million EURe in the affected storage account.<\/li>\n<\/ul>\n<p>Efforts by BitFinding and <span data-descr=\"maximal extractable value\" class=\"old_tooltip\">MEV<\/span> bots Base <a href=\"https:\/\/x.com\/BitFinding\/status\/1985542900873072882\">recovered<\/a> about $750,000.<\/p>\n<p>According to developers, the previously adopted Safe Harbor legal framework (<a href=\"https:\/\/forum.balancer.fi\/t\/bip-726-adopt-the-seal-safe-harbor-agreement\/6087\/7\">BIP-726<\/a>) \u201csignificantly improved response speed and coordination.\u201d<\/p>\n<p>The exact amount of recovered funds is still unknown. The Balancer team promised to report on the final losses and recovered assets after the audit is completed.<\/p>\n<p>As reported, the DeFi protocol <a href=\"https:\/\/forklog.com\/en\/news\/balancer-defi-protocol-suffers-128m-hack\">was hacked<\/a> on November 3. The attack lasted several hours.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The hack on the DeFi protocol Balancer was attributed to a flaw in one of the platform&#8217;s key components\u2014the Composable Stable pools.<\/p>\n","protected":false},"author":1,"featured_media":90733,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Balancer hack attributed to Composable Stable pools flaw.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1856,1154,1093],"class_list":["post-90732","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-balancer-bal","tag-crimes","tag-defi"],"aioseo_notices":[],"amp_enabled":true,"views":"323","promo_type":"1","layout_type":"1","short_excerpt":"Balancer hack attributed to Composable Stable pools flaw.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/90732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=90732"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/90732\/revisions"}],"predecessor-version":[{"id":90734,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/90732\/revisions\/90734"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/90733"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=90732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=90732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=90732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}