Balancer Hack Exposes $116M Smart Contract Vulnerability

The attack exploited vulnerabilities in smart contract interactions. This allowed an attacker to manipulate pool operations and drain funds in a matter of minutes.

Preliminary analysis by on-chain investigators indicates that a maliciously deployed contract exploited the vault’s initialization process, bypassing safeguards intended to prevent unauthorized swaps and balance manipulations. While the full forensic report is still pending from auditors like PeckShield and Nansen, early data shows that roughly $110–116 million in Ethereum and other assets were stolen.

How the Attack Worked in Balancer?

The breach leveraged Balancer’s composable design, where pools interact extensively, amplifying the vulnerability. Improper authorization and callback handling allowed the attacker to execute a sequence of rapid transactions, beginning with a key Ethereum mainnet transaction. Funds were subsequently funneled to a new wallet, likely for laundering through mixers or cross-chain bridges.

The main stolen assets included WETH, wstETH, osETH, frxETH, rsETH, and rETH, with the bulk of the losses, around $70 million, coming from Ethereum. Additional losses on Base and Sonic networks totaled $7 million, with other chains accounting for $2 million or more. This type of exploit highlights a recurring risk in AMMs and DeFi platforms, particularly involving deflationary tokens and complex pool rebalancing.

Investors exposed to Balancer V2 pools should act quickly. Withdraw funds immediately if possible and avoid affected pools. Cancel any smart contract approvals linked to Balancer addresses using tools like Revoke, DeBank, or Etherscan to prevent further unauthorized interactions. Monitoring wallets via Etherscan or Dune Analytics can help detect suspicious activity in real time. Staying informed is crucial—follow updates from PeckShieldAlert, lookonchain, and Balancer’s official channels to track recovery efforts and forensic findings.

More About the Balancer Hack

Balancer had undergone over ten audits, with its V2 vault reviewed three separate times by different firms, yet it still suffered a $110 million hack. This incident highlights a harsh reality in decentralized finance: “audited by X” offers little guarantee.

Writing secure code is challenging, and building composable DeFi systems is even harder. While it is unfortunate for users and the protocol, there is hope that the Balancer team can recover and learn from this setback, reinforcing the importance of caution and continuous improvement in the rapidly evolving DeFi space.

Disclaimer

The information provided by Altcoin Buzz is not financial advice. It is intended solely for educational, entertainment, and informational purposes. Any opinions or strategies shared are those of the writer/reviewers, and their risk tolerance may differ from yours. We are not liable for any losses you may incur from investments related to the information given. Bitcoin and other cryptocurrencies are high-risk assets; therefore, conduct thorough due diligence. Copyright Altcoin Buzz Pte Ltd.