Nansen

Lido wstETH

StakeWise Staked ETH

Balancer

Update Nov. 3, 10:42 am UTC: This article has been updated to include a section on Berachain’s emergency hard fork.
Update Nov. 3, 9:47 am UTC: This article has been updated to add the latest figures, Balancer’s white hat bounty offer and comments from Nicolai Sondergaard, research analyst at Nansen.
Update Nov. 3, 9:21 am UTC: This article has been updated to include a section on the Balancer flash loan attack from 2020.
The decentralized exchange (DEX) and automated market maker (AMM) Balancer has been exploited, with more than $116 million worth of digital assets transferred to a newly created wallet.
“We’re aware of a potential exploit impacting Balancer v2 pools. Our engineering and security teams are investigating with high priority,” the Balancer team said in a Monday X <a href="https://x.com/Balancer/status/1985283356582453588" rel="noopener noreferrer nofollow" target="https://x.com/Balancer/status/1985283356582453588">post</a>, adding that it will share more updates as information becomes available.
Onchain data initially showed that the <a href="https://cointelegraph.com/learn/articles/defi-a-comprehensive-guide-to-decentralized-finance" rel="noopener noreferrer nofollow">decentralized finance (DeFi)</a> protocol was exploited for $70.9 million worth of liquid staked Ether (<a href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow" target="_self">ETH</a>) tokens transferred to a fresh wallet across three transactions, <a href="https://etherscan.io/tx/0xd155207261712c35fa3d472ed1e51bfcd816e616dd4f517fa5959836f5b48569" rel="noopener noreferrer nofollow" target="_blank">according</a> to Etherscan logs.
The transfers included 6,850 StakeWise Staked ETH (OSETH), 6,590 Wrapped Ether (WETH) and 4,260 Lido wstETH (wSTETH), crypto intelligence platform Nansen said in a Monday X <a href="https://x.com/nansen_ai/status/1985257594525721081" rel="noopener noreferrer nofollow" target="_blank">post</a>.
By 8:52 am UTC on Monday, the ongoing exploit has swelled to over $116.6 million in stolen funds, <a href="https://x.com/lookonchain/status/1985268858299846841" rel="noopener noreferrer nofollow" target="_blank">according </a>to blockchain data platform Lookonchain.
<figure>
 <img alt="Cryptocurrencies, Phishing, Security, Technology, Hackers, Cryptocurrency Exchange, Tokens, Cybersecurity, Scams, Hacks, Stablecoin, Web3, Web3 Decentralization Initiatives, Nansen" src="https://s3.cointelegraph.com/uploads/2025-11/019a493f-a514-7804-bc6f-1f94d05d66f0" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/lookonchain/status/1985268858299846841/photo/1" rel="noopener noreferrer nofollow" target="https://x.com/lookonchain/status/1985268858299846841/photo/1">Lookonchain</a>
 </figcaption>
</figure>
The Balancer exploit may stem from smart contract issues that had a “faulty access check allowing the attacker to send a command to withdraw funds,” Nicolai Sondergaard, research analyst at Nansen, told Cointelegraph, adding:
<blockquote>
 “From what I see, losses are now greater than $100 million and have affected Balancer v2 + various forks.”
</blockquote>
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-11/019a48e2-26ce-740a-96a6-ab60460ed1f8" title="" alt="Balancer exploit swells to $116M in outflows as team offers 20% bounty">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/nansen_ai/status/1985257594525721081/photo/1" rel="noopener noreferrer nofollow" target="https://x.com/nansen_ai/status/1985257594525721081/photo/1">Nansen</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/cz-crypto-seal-60-north-korean-hackers" rel="noopener noreferrer nofollow">CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea</a>
<h2 id="balancer-offers-a-20-white-hat-bounty-for-return-of-the-funds">Balancer offers a 20% white hat bounty for return of the funds</h2>
Aiming to recover the funds, the team behind Balancer offered a white hat bounty of up to 20% of the stolen funds if the full amount, minus the reward, is returned immediately.&nbsp;
If the funds are not returned within the next 48 hours, Balancer stated that it will continue to cooperate with blockchain forensics specialists and law enforcement agencies to identify the perpetrator.
“Our partners have a high degree of confidence you will be identified from access-log metadata collected by our infrastructure, indicating connections from a defined set of IP addresses/ASNs and associated ingress timestamps that correlate with the transaction activity on chain,” <a href="https://etherscan.io/tx/0xbf9875045085cdb1b44822dd6ed68c9e5970b102d6fa9a98c64f7a5a1eba60a7" rel="noopener noreferrer nofollow" target="_blank">said</a> Balancer in a blockchain transaction note on Monday.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-11/019a4924-dea2-798f-ab2f-41879c9e33dd" title="" alt="Balancer exploit swells to $116M in outflows as team offers 20% bounty">
 <figcaption style="text-align: center;">
 Balancer white hat bounty offer. Source: Etherscan.io
 </figcaption>
</figure>
Two years ago, Balancer suffered a domain name system (DNS) attack on its front end website, the protocol <a href="https://x.com/Balancer/status/1704281611326357567" rel="noopener noreferrer nofollow" target="_blank">revealed</a> at the time. Hackers redirected the website’s users to a phishing website associated with malicious smart contracts aiming to steal user funds.
About $238,000 worth of digital assets were stolen during the phishing attack, <a href="https://x.com/zachxbt/status/1704286832844828914" rel="noopener noreferrer nofollow" target="_blank">according</a> to blockchain sleuth ZachXBT.
In August 2023, Balancer also <a href="https://x.com/Meir_Dv/status/1695786374186549540" rel="noopener noreferrer nofollow" target="_blank">suffered</a> an almost $1 million stalecoin exploit, just a week after the protocol disclosed a “critical vulnerability” related to some of its liquidity pools.&nbsp;
In June 2020, <a href="https://cointelegraph.com/news/defi-protocol-balancer-hacked-through-exploit-it-seemingly-knew-about" rel="noopener noreferrer nofollow" target="_self">Balancer was hacked</a> for $500,000 worth of Ether and other tokens as part of a flash loan attack based on the Statera (STA) deflationary tokens, where 1% of every transaction is automatically burned.
<h2 id="berachain-orchestrates-emergency-network-halt-after-balancer-exploit">Berachain orchestrates emergency network halt after Balancer exploit</h2>
Validators behind the <a href="https://cointelegraph.com/news/berachain-joins-race-for-real-time-blockchains-with-sub-second-transactions" rel="noopener noreferrer nofollow">Berachain blockchain</a> have rushed to halt the network to perform an emergency update, or hard fork, following the Balancer exploit.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-11/019a494e-7c44-7900-937f-d83b56795630" title="" alt="Balancer exploit swells to $116M in outflows as team offers 20% bounty">
 <figcaption style="text-align: center;">
 Source: Berachain <a href="https://x.com/berachain/status/1985288599152042101" rel="noopener noreferrer nofollow" target="https://x.com/berachain/status/1985288599152042101">Foundation</a>
 </figcaption>
</figure>
The emergency hard fork aims to address the Balancer exploit related to specific assets on Berachain’s native DEX, <a href="https://x.com/berachain/status/1985288599152042101" rel="noopener noreferrer nofollow" target="_blank">wrote</a> the Berachain Foundation in a Monday X post, adding:
<blockquote>
 “This halt has been executed purposefully, and the network will be operational shortly upon recovering all affected funds.”
</blockquote>
“Given that it affected non-native assets (not just BERA), the rollback/rollforward involves more than a simple hardfork, hence the halt as a full solution is finalized,” added the foundation.<iframe width="100%" height="315" src="https://www.youtube.com/embed/NDv0RfehETQ?start=" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/coinbase-hack-law-protect-heres-why/" rel="noopener noreferrer nofollow">Coinbase hack shows the law probably won’t protect you — Here’s why</a>

Balancer exploit swells to $116M in outflows as team offers 20% bounty

Table of Contents

Cointelegraph

Other articles published on Nov 3, 2025

Join our free newsletter for daily crypto updates!