The hack was one of the тАЬmost sophisticatedтАЭ attacks so far in 2025, according to Deddy Lavid, CEO of blockchain security company Cyvers.
The team behind decentralized finance (DeFi) protocol Balancer published a preliminary post-mortem report on Wednesday, detailing the cause of the exploit that siphoned $116 million across DeFi markets.
Balancer was hit by a sophisticated code exploit on Monday that targeted Balancer v2 Stable Pools and Composable Stable v5 pools, while all other pool types remained unaffected, according to the report.
The hacker used a combination of BatchSwaps, which allow the user to bundle multiple actions in a single transaction, including flashloans тАФ short-term loans borrowed and repaid within the same transaction тАФ and an exploit of the upscale rounding function that affects EXACT_OUT swaps in the Stable Pools.
Source: Balancer
The rounding function is intended to round down when token prices are an input. However, the hacker was able to manipulate these rounding values, and in conjunction with the BatchSwap feature, drained funds from the stable pools. The team wrote:
тАЬIn many instances, the exploited funds remained within the Vault as internal balances before being withdrawn in subsequent transactions.тАЭ
The hack serves as a reminder that hot wallets, liquidity pools and onchain funds exposed to the internet are vulnerable to evolving cybersecurity threats from hackers, prompting crypto users and blockchain developers to practice caution in protecting funds.
Balancer responds to $116 million hack with crypto industrys help
The hackers were likely skilled professionals who prepared for months before executing their attack, using a series of 0.1 Ether (ETH) Tornado Cash deposits to fund the attack to avoid detection, Cointelegraph previously reported.
Balancer worked with cybersecurity partners and crypto protocols to claw back or freeze a portion of the stolen funds, including 5,041 StakeWise Staked ETH (osETH), valued at about $19 million, and 13,495 osGNO tokens valued at up to $2 million.
Source: BitFinding
The team has paused all affected pools and disabled the creation of new тАЬvulnerableтАЭ pools until the security issue is fixed.
Balancer offered a 20% white hat bounty to ethical hackers and the perpetrator for the return of the stolen funds, but no one had claimed the bounty as of this writing.