Balancer Hit by Smart Contract Exploit, $116M Vulnerability Revealed
During the past three months, Balancer, the second most popular and high-profile cryptocurrency in the decentralized finance ecosystem has been subjected to a number of high-profile attacks from sweeping cross-chain exploits that have rapidly emerged to be one of the most significant cryptocurrency breaches over the past year.
The results of early blockchain forensic analysis suggest losses of $100 million to $128 million, and the value of assets that have now been compromised across multiple networks has risen to $116 million, according to initial assessments circulated by independent researchers. In particular, @RoundtableSpace shared data with us on the X platform. In addition to disrupting the Ethereum mainnet as well as several prominent layer-2 networks, the incident also caused liquidity pools on Ethereum's mainnet to be disrupted.
Almost immediately after the attack, Balancer's team recognized it and began a quick investigation into the attack, working closely with the leading blockchain security firms to contain the damage and determine the scope of the problem. It has sent ripples throughout the DeFi community, raising fresh concerns about the protocol's resilience as attackers continue to exploit complex multi-chain infrastructures to steal data.
In light of the breach, investigators have since determined that it is a result of a flaw within Balancer's smart contracts, wherein a flaw in initialization allowed an unauthorized manipulator to manipulate the vault. Blockchain analysts have been able to determine that, based on early assessments, the attacker used a malicious contract to bypass safeguards intended to prevent swaps and imbalance across pools and circumvent the exchanges.
There was a striking speed at which the exploit unfolded: taking advantage of Balancer's deeply composable architecture, in which multiple pools and contracts are often intertwined, the attacker managed to orchestrate multiple tight-knit transactions, starting with a critical Ethereum mainnet call. Through the use of incorrect authorization checks and callback handling, the intruder was able to redirect liquidity and drain assets in a matter of minutes.
There is still a long way to go until full forensic reports from companies like PeckShield and Nansen are released, but preliminary data suggests that between $110 million and $116 million has been siphoned into a new wallet in Ethereum and other tokens. As the funds appear to be moving through mixers and cross-chain routes to obscurity their origin, their origin appears to be obscured in the new wallet.
When investigators dissected Balancer V2's architecture, they discovered a fundamental flaw within the vault and liquidity pools, which led them to find out that the breach occurred as a result of a fundamental breach within the protocol.
The Composability of Balancer's V2 design made it among the most widely used automated market makers, an attribute that in this instance accentuated the impact of the vulnerability.
Upon investigation, it was found that the attacker had implemented a malicious contract that interfered with the pool initialization sequence of the platform, manipulating internal calls that govern the changing of balances and swapping permissions within the platform.
Specifically, the validation check that is meant to enforce internal safeguards within the manageUserBalance function was flawed, which allowed the intruder to sidestep critical authorization steps and bypass the validation check.
It is because of this loophole that the attacker could submit unauthorized parameters and siphon funds directly from the vault without activating the security measures Balancer believed were in place.
It was an extremely complex operation that unfolded first on Ethereum's mainnet, where it was triggered by a series of precisely executed transactions before it spread to other networks that had been integrated with the V2 vault.
According to preliminary assessments, the total losses will amount to between $110 million and $116 million, although some estimates place it at $128 million.
This is one of the most consequential DeFi incidents in 2025. There were several liquid-staking derivatives and wrapped tokens that were stolen, including WETH, wstETH, OsETH, frxETH, rsETH, and rETH.
A total of $70 million was sucked from Ethereum alone, while the Base and Sonic networks accounted for a loss of approximately $7 million, along with additional losses from smaller chains as well.
In the cryptography records on the blockchain, it can be seen that the attacker quickly routed the proceeds into newly created wallets and then into a privacy mixer after they had been routed through bridges.
The investigators stressed, however, that no private keys were compromised; the incident had only a direct impact on Balancer's smart contract logic and not any breach of user credentials, according to their findings.
As a result of the breach, security experts have advised that users who have access to balancer V2 pools to take immediate precautions.
It has been recommended by analysts that pool owners withdraw their funds from any affected pools without delay and revoke smart-contract approvals tied to Balancer addresses through platforms such as Revoke, DeBank, or Etherscan that can be accessed instantly.
In addition to being advised to closely monitor their wallets using on-chain tools Like Dune Analytics and Etherscan to find out if any irregular activities are occurring, users should also follow the ongoing updates from auditing and security firms including PeckShield and Nansen as this investigation moves forward.
As a consequence of the incident, there have already been noticeable effects in the broader DeFi market, such as Balancer's BAL token dropping by 5% to 10%, and the platform's overall value locking experiencing a sharp decline in value as liquidity providers began to withdraw their services in response to mounting uncertainty.
As noted in industry observers, the episode emphasizes the inherent challenges that come with constructing secure and composable financial primitives. However, they also note that such setbacks often lead to crucial improvements. The Balancer team seems hopeful that they will be able to recover, strengthen their infrastructure, and emphasize the importance of being vigilant and continuously refining their skills in an environment that changes as quickly as the threats that surround it.
Several experts have commented on the Balancer incident, emphasising that it should serve as a catalyst for enhancing security practices across the DeFi landscape as the investigation continues. Specifically, they say protocols must reevaluate assumptions regarding composability, perform more rigorous pre-deployment testing, and implement continuous audit cycles in order to minimize the likelihood of similar cascading failures occurring in the future.
It is clear from this episode that users should be careful with the allocation of liquidity, monitor on-chain activity regularly, and exercise vigilant approval management. Although the breach has shaken confidence in the sector, it also represents an opportunity for the sector to grow, innovate responsibly, and strengthen the resilience of decentralized finance despite the disruption.
