StakeWise

Sonic

Berachain

Balancer

<div class="wp-block-group has-background is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex" style="background-color:#abb7c226;font-style:normal;font-weight:200">
 <p><strong>Key Highlights</strong></p>
 <ul>
  <li>Balancer confirmed a $117 million exploit on its V2 Stable Pools across nine blockchains, caused by a “rounding error” in the smart contract code, not a private key theft.</li>
  <li>While newer V3 pools were unaffected, partner chain Berachain took the controversial step of halting its entire network, a move that successfully led to the full recovery of its $12.8 million in lost funds.</li>
  <li>This hack is a powerful lesson in the hidden systemic risks of “composable” DeFi, where a single, minor code flaw can cascade into a catastrophic, multi-chain failure.</li>
 </ul>
</div>
<p>Less than 48 hours after confirming one of the largest decentralized finance (DeFi) breaches of the year, Balancer has released its preliminary incident report, detailing how a rounding error and batch-swap exploit drained more than $117 million from its V2 Composable Stable Pools across multiple networks.</p>
<p>The <a href="https://x.com/Balancer/status/1986104426667401241" target="_blank" rel="noopener noreferrer nofollow">report</a> follows a chaotic week that shook the DeFi sector, exposing vulnerabilities in legacy smart contracts even as Balancer’s newest version, V3, remains unaffected. In parallel, Berachain, one of the networks hit during the exploit, announced the recovery of its entire $12.8 million loss, marking one of the rare full restitution cases in DeFi history.</p>
<h2 class="wp-block-heading" id="how-the-exploit-unfolded">How the exploit unfolded</h2>
<p>According to Balancer’s report, the attack began at 07:46 UTC on Monday, when monitoring system Hypernative flagged abnormal behavior across V2 Composable Stable Pools on Ethereum, Base, Avalanche, Arbitrum, Optimism, Polygon, Gnosis, Berachain, and Sonic.</p>
<p>The attacker exploited a flaw in the upscale function, specifically how EXACT_OUT swaps handled non-integer scaling factors, to manipulate pool balances.&nbsp;</p>
<p>Combined with the protocol’s batchSwap deferred settlement feature, the exploit allowed attackers to repeatedly drain funds while bypassing the minimum pool supply limit.</p>
<p>While Balancer has not confirmed final loss figures, the <a href="https://www.cryptotimes.io/2025/11/04/balancer-confirms-116m-exploit-multiple-projects-affected/" target="_blank" rel="noopener noreferrer nofollow">$117 million estimate remains the most cited</a> by independent analysts. The protocol emphasized that V3 and all non-stable pool types were unaffected and that containment measures, including automated pausing of v6 pools and white-hat recoveries, prevented further losses.</p>
<h2 class="wp-block-heading" id="containment-and-partial-fund-recovery">Containment and partial fund recovery</h2>
<p>Rapid intervention helped stem the damage across networks. Balancer credits Hypernative, SEAL Safe Harbor, and multiple white-hat teams for recovering or freezing a portion of affected funds. Among the mitigations:</p>
<ol>
 <li>StakeWise recovered roughly $19 million in osETH and $2 million in osGNO, totaling nearly 73% of affected assets.</li>
</ol>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Just half an hour earlier, StakeWise DAO emergency multisig has executed a series of transactions, recovering ~5,041 osETH (~$19M) and 13,495 osGNO (~$1.7M) tokens from the Balancer exploiter.<br><br>On Ethereum mainnet, this represents 73.5% of the ~6,851 osETH stolen earlier today,… <a href="https://t.co/b43EGf92hm" rel="noopener noreferrer nofollow">pic.twitter.com/b43EGf92hm</a></p>— StakeWise (@stakewise_io) <a href="https://twitter.com/stakewise_io/status/1985462161670336944?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 3, 2025</a>
  </blockquote>
 </div>
</figure>
<ol>
 <li>Sonic Labs froze attacker wallets linked to Beets Finance, a Balancer fork on Sonic.</li>
</ol>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>At approximately 3:45 AM EST on November 3rd, 2025, the Sonic security team was notified of suspicious activity involving a potential exploit on the <a href="https://twitter.com/beets_fi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@Beets_Fi</a> protocol.<br><br>As a precautionary measure, the team deployed a safety mechanism planned to be implemented in an upcoming…</p>— Sonic (@SonicLabs) <a href="https://twitter.com/SonicLabs/status/1985401737096671549?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 3, 2025</a>
  </blockquote>
 </div>
</figure>
<ol>
 <li>BitFinding and Base MEV bots retrieved over $750,000 combined.</li>
</ol>
<figure class="wp-block-embed aligncenter is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>All funds were returned back to the <a href="https://twitter.com/Balancer?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@Balancer</a> DAO <a href="https://t.co/OgY3omfbYn" rel="noopener noreferrer nofollow">https://t.co/OgY3omfbYn</a> <a href="https://t.co/3qUBdb6hGw" rel="noopener noreferrer nofollow">pic.twitter.com/3qUBdb6hGw</a></p>— BitFinding (@BitFinding) <a href="https://twitter.com/BitFinding/status/1985542900873072882?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 4, 2025</a>
  </blockquote>
 </div>
</figure>
<p>Balancer confirmed that a full post-mortem will follow, with independent auditors and partners verifying on-chain data, frozen assets, and recovery actions before publishing final figures.</p>
<h2 class="wp-block-heading" id="berachain-achieves-full-restitution">Berachain achieves full restitution</h2>
<p>Meanwhile, Berachain confirmed the <a href="https://www.cryptotimes.io/2025/11/05/berachain-recovers-12-8m-lost-in-balancer-hack-resumes-operations/" target="_blank" rel="noopener noreferrer nofollow">complete recovery of its $12.8 million</a> lost during the Balancer exploit, crediting swift validator coordination and assistance from a white-hat hacker who returned the funds.</p>
<p>The network had halted block production within hours of detecting the exploit, freezing attacker activity and later issuing an emergency hard fork to prevent further transfers.</p>
<p>Berachain’s Chief Smokey Officer, Smokey The Bera, defended the controversial network halt: “When roughly $12 million of user funds are at risk, our priority is protecting the community. Pausing operations wasn’t ideal, but it prevented total loss.”</p>
<p>Berachain has since resumed all operations, including HONEY minting and redemption, and said it may issue a bounty reward to the white-hat contributor who helped return the assets.</p>
<h2 class="wp-block-heading" id="the-bigger-picture-defi-s-recurring-pain-point">The bigger picture: DeFi’s recurring pain point</h2>
<p>While Balancer’s transparency and recovery coordination have been praised, the incident underscores a deeper issue within DeFi, complex smart contract design and fragmented auditing standards.</p>
<p>Composable architecture, once touted as a key DeFi innovation, continues to introduce hidden <a href="https://www.cryptotimes.io/2025/11/04/chainalysis-warns-defis-150b-market-faces-growing-security-risks/" target="_blank" rel="noopener noreferrer nofollow">attack surfaces and security risks</a>. Balancer’s miscalculated rounding logic is just the latest example of how minor arithmetic flaws can cascade into multimillion-dollar exploits across chains.</p>
<p>Balancer team cautioned that public estimates remain unofficial until reconciled through partner verification. It urged users to avoid interacting with affected pools and to monitor only its official X and Discord channels for updates.</p>
<p>The company says recovery efforts under the SEAL Safe Harbor framework continue, with zeroShadow and BitFinding tracing assets. A full post-mortem and migration plan to V3 are next.&nbsp;</p>
<p>For DeFi, the saga is another warning: even in “trustless” systems, safety still depends on human vigilance, and white-hats fixing what code can’t.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also read: <a href="https://www.cryptotimes.io/2025/11/04/balancer-attacker-begins-swapping-stolen-funds-for-eth/" target="_blank" rel="noopener noreferrer nofollow">Balancer Attacker Begins Swapping Stolen Funds for ETH</a></p>
</blockquote>

Balancer Releases Preliminary Incident Report Of $117M Exploit

Table of Contents

The Crypto Times

Other articles published on Nov 5, 2025

Join our free newsletter for daily crypto updates!