Pool Token

DeFi

Stable

Balancer

In one of the most complex DeFi attacks of 2025, <a href="https://coindoo.com/balancer-community-unveils-plan-to-compensate-users-after-116m-hack/" target="_blank" rel="noopener noreferrer nofollow">Balancer protocol</a> lost more than $128 million on November 3, 2025, when hackers exploited a hidden vulnerability in its v2 Stable Pools.
The attack targeted the rounding mechanism of the “upscale” function for EXACT_OUT swaps, which allowed invalid upward rounding through manipulated inputs and batched transactions that drained the funds repeatedly in a single block.&nbsp;
The Balancer decentralized autonomous organization has now introduced a formal governance proposal to distribute $27.7 million in recovered assets to users that were affected in the November 3 hack.
WETH, osETH, and wstETH were some of the assets siphoned across multiple chains: <a rel="noopener noreferrer nofollow" target="_blank" href="https://med.etoro.com/B10215_A67747_TClick_Scb-ethereum.aspx?TargetURL=https://www.etoro.com/markets/eth">Ethereum</a>, which suffered the biggest loss at $99 million, with additional losses across Arbitrum, Base, Berachain, Optimism, <a rel="noopener noreferrer nofollow" target="_blank" href="https://med.etoro.com/B10215_A67747_TClick_Scb-Polygon.aspx?TargetURL=https://www.etoro.com/markets/pol">Polygon</a>, and Sonic.
Despite eleven audits that were carried out by four separate security companies, the vulnerability remained undetected until the exploit happened. Cyvers CEO Deddy Lavid described the operation as “one of the most advanced attacks of the year,” citing the evidence that the attacker prepared for months and subsequently laundered proceeds through Tornado Cash.
Following the attack, Balancer froze the affected pools to stop further losses and released a <a href="https://www.tradingview.com/news/cointelegraph:123e17fd2094b:0-balancer-releases-preliminary-post-mortem-report-after-116m-hack/" target="_blank" rel="noopener noreferrer nofollow">preliminary post-mortem</a> shortly afterward, confirming the root cause and issuing warnings about ongoing risks to hot wallets and on-chain liquidity exposure. The incident affected thousands of liquidity providers and the overall market, followed by a temporary dip in unrelated tokens such as <a rel="noopener noreferrer nofollow" target="_blank" href="https://med.etoro.com/B10215_A67747_TClick_Scb-sui.aspx?TargetURL=https://www.etoro.com/markets/sui">SUI</a>.
<h2 id="b-how-balancer-plans-to-return-27-7-million-only-to-direct-victims-b">How Balancer Plans to Return $27.7 Million Only to Direct Victims&nbsp;</h2>
Three weeks after the breach, the Balancer DAO has come forward with a <a href="https://forum.balancer.fi/t/rfc-distribution-of-rescued-funds-from-balancer-v2-november-3rd-2025-attacks/6883" target="_blank" rel="noopener noreferrer nofollow">governance proposal</a> to return recovered funds to victims of the attack without socializing losses across the broader protocol.&nbsp;
The plan, posted to the governance forum on November 27, 2025, will follow two distinct recovery streams.
An $8 million tranche recovered through white-hat interventions and internal efforts will be distributed proportionally to Balancer Pool Token (BPT) holders in the directly affected pools, paid in the original stolen assets. A separate $19.7 million tranche recovered by liquid-staking partner StakeWise, primarily osETH and osGNO, will be forwarded independently by StakeWise to its affected users.
The combined $27.7 million represents approximately 22% of total losses. Distributions will be strictly non-socialized, limited exclusively to liquidity providers who held BPT positions in the exploited pools at the time of the <a href="https://www.cryptobreaking.com/bybit-hack-causes-setback-for-institutional-staking-adoption-says-everstake-executive/" target="_blank" rel="noopener noreferrer nofollow">attack</a>, and will require acceptance of updated terms of service.
The proposal is currently in the community discussion phase ahead of an on-chain DAO vote. If approved, a claims portal is expected to launch within weeks.
Community reactions remain divided; some members remain optimistic, while others criticize the decision. Some liquidity providers have praised the targeted approach as a “community-first” gesture that prioritizes direct victims over broad bailouts, while others contend the partial recovery has some shortcomings in audit effectiveness and overall DeFi risk management.
This article was originally published as <a href="https://www.cryptobreaking.com/balancer-suffers-128-64-million/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Balancer Suffers $128.64 Million Hack in One of 2025’s Most Advanced DeFi Hacks</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.

Balancer Suffers $128.64 Million Hack in One of 2025’s Most Advanced DeFi Hacks

Table of Contents

Crypto Breaking News

Other articles published on Nov 30, 2025

Join our free newsletter for daily crypto updates!