DEX
Balancer
balancer.fi ↗BAL market data →
Also known as Balancer Protocol, Balancer Labs, Balancer DAO, BAL, veBAL, Balancer v2, Balancer v3
balancer hack
On 3 November 2025 an attacker exploited a rounding error in Balancer v2's Composable Stable Pools and took more than $128 million across several chains in about an hour. Whitehats and emergency actions saved about $8 million, plus about $19.7 million handled by StakeWise, and the rest was not recovered. The damage led to Balancer Labs shutting down in March 2026, and in September 2026 the DAO voted on winding the protocol down.
Our read
Balancer built the most flexible pool design in DeFi, and in 2025–26 that flexibility cost it dearly: one rounding flaw in v2 took $128M, and a legacy v1 bug followed in August 2026. As of 27 September 2026 a wind-down vote is live and passing, which would put pools into withdrawals-only on 30 October 2026. If you still have liquidity on Balancer, the practical advice is simple: plan your exit now and watch the result of BIP-928.
Key facts
- November 2025 v2 exploit
- More than $128 million taken across several chains in about an hour
- Nov 2025 · Rekt ↗
- Funds rescued in the v2 exploit
- About $8M by whitehats and internal rescue, plus about $19.7M in osETH/osGNO handled by StakeWise
- Nov 2025 · Balancer Forum ↗
- Balancer Labs
- Co-founder Fernando Martinelli announced Balancer Labs would wind down, citing legal exposure from the exploit
- Mar 2026 · Balancer Forum ↗
- Wind-down vote (BIP-928)
- Snapshot open 25–29 Sep 2026; about 12.2M BAL for, none against, quorum 5M
- Sep 2026 · Snapshot ↗
The Balancer hack of November 2025: what happened
On 3 November 2025 an attacker drained Balancer v2 Composable Stable Pools on Ethereum and several other chains. The flaw was in the `_upscale()` scaling function, which always rounded down. A code comment had called the resulting error "expected to be minimal". With carefully sized swaps, the attacker turned that one-directional rounding into a way to manipulate pool rates and pull out more than $128 million in about an hour (Rekt). Forks of Balancer v2 on other chains had inherited the same code and were hit too.
The history is uncomfortable. Certora had formally verified Balancer v2's key solvency properties in 2022, but those proofs did not cover rounding direction. Trail of Bits had flagged similar rounding concerns in Linear Pools about four years earlier. Balancer had been audited repeatedly. What failed was a small arithmetic detail that nobody's audit scope covered.
| Recovery item | Amount | Status |
|---|---|---|
| Rescued by whitehats and emergency actions | About $8M | Returned to LPs pool by pool through a Merkle claim, minus a 10% whitehat bounty (BIP-892) |
| osETH / osGNO handled by StakeWise | About $19.7M | Handled separately by StakeWise |
| Unclaimed after six months | About $920K (about 500 ETH) | Claim window extended to 12 months (BIP-923) |
| Rebates from Ethena and ShapeShift | 12,518 USDe + 133,905 USDC | Held by the DAO pending a distribution decision |
| Attacker wallets | About 21,000 ETH | Dormant as of March 2026 |
Balancer did not make LPs whole from its treasury. Claims were paid in kind and not socialised: each pool's LPs share only what was rescued from that pool (BIP-892). Most of the $128M was not recovered.
Balancer Labs shutdown and the 2026 wind-down vote
On 23 March 2026 co-founder Fernando Martinelli announced that Balancer Labs, the company that built the protocol, would wind down. He said the exploit had created "real and ongoing legal exposure" and that the company had no revenue to sustain itself. Essential staff were to move to a DAO-funded Balancer OpCo. He argued against closing the protocol, which he said was earning over $1 million a year in fees (Balancer Forum). In April token holders approved a restructuring that cut costs, ended BAL emissions and routed revenue to the DAO.
The recovery did not come. On 14 September 2026 BIP-928 proposed an orderly wind-down of the whole protocol (Balancer Forum):
| Date | What happens if BIP-928 passes |
|---|---|
| 30 Oct 2026 | Pools move to withdrawals only, where the contracts allow it; bug bounty coverage ends for every pool |
| 31 Oct 2026 | Contributor notice ends |
| 30 Nov 2026 | v3 pools that partners asked to keep open are paused with the v3 Vault |
| End of May 2027 | Round one: BAL holders burn BAL for a pro-rata share of the treasury (at least $9M at current prices) |
| About two months later | Round two airdrop to round-one redeemers, then a final sweep six months after that |
The Snapshot vote runs from 25 to 29 September 2026. It was reset once on 26 September after delegation votes were counted wrongly. At the time of checking, about 12.2 million BAL had voted for, split between two Yes options that differ only in how tetuBAL holders are treated, with none against and a quorum of 5 million. A competing proposal, BIP-929 "Fork and Reincarnate", would have a team called MAXYZ lead an official fork and keep pools open until mid-2027. It was losing, about 7.2 million BAL against 4.8 million for.
If you provide liquidity on Balancer, do not wait for 30 October. Withdrawals-only still lets you exit, but bug-bounty coverage ends that day and legacy code will be left running with no maintainers.
What Balancer Finance is: weighted pools, v2 and v3
Balancer generalised the AMM. Instead of a 50/50 pair, a weighted pool can hold several tokens in any proportion, for example 80% of a governance token and 20% ETH. That works like a self-rebalancing index fund whose rebalancing is paid for by traders. Later designs added Composable Stable Pools for pegged assets, Boosted Pools that lend idle liquidity to money markets, and in v3 AutoRange pools.
| Version | Design | Status in September 2026 |
|---|---|---|
| v1 (2020) | Separate contract per pool; immutable; no pause | Exploited on 31 Aug 2026 through a rounding flaw; about $1.39M drained |
| v2 | One Vault holding every pool's tokens | Exploited Nov 2025; about $30M TVL left |
| v3 | Rebuilt Vault; Boosted and AutoRange pools | About $22M TVL; partners may keep pools open to 30 Nov 2026 |
The single-Vault design made v2 cheap for multi-hop trades. It also meant one flaw in shared pool maths could hit every pool of that type at once, which is what happened. Balancer processed about $133.5 billion of volume over its lifetime but only about $292 million in the 30 days to 27 September 2026 (DefiLlama). The Balancer card holds our scored assessment. BAL token data is on our market page.
Incident log
5 entries · $132M lost in total · repaid, confirmed: 0 of 5 where user funds were at stake
Exploit$1.4M
Legacy Balancer v1 pools drained through rounding in single-sided joins
An attacker flash-loaned a low-decimals token's reserves down to dust, so the single-sided join truncated the required input to almost nothing while minting full pool tokens. Copycats repeated it across the remaining v1 pools, which are immutable and cannot be paused. About $1.39M was drained.
Partly repaidThe main exploiter, identified as a greyhat, returned part of the funds to the DAO multisig, and whitehats intercepted some copycat transactions. A distribution proposal was posted on 18 September 2026; copycat proceeds went to mixers.Exploit$128M
Composable Stable Pool rounding exploit drains Balancer v2
A one-directional rounding error in _upscale() let an attacker manipulate rates in v2 Composable Stable Pools across Ethereum and other chains, taking more than $128M in about an hour. Forks using the same code were also hit.
Partly repaidAbout $8M was rescued and returned by pool through Merkle claims (less a 10% whitehat bounty), and about $19.7M in osETH/osGNO was handled by StakeWise. No treasury-funded reimbursement; about 21,000 ETH sat in dormant attacker wallets in March 2026.Hack$238K
Front-end DNS attack
Attackers hijacked Balancer's domain and served a malicious front end; users who approved transactions lost about $238K.
Partly repaidBIP-443, BIP-455 and BIP-498 refunded users who reported losses, with a 25% cut in the final batch.Exploit$2.1M
Rate manipulation in v2 Boosted Pools
Five days after Balancer warned LPs to withdraw from vulnerable Boosted Pools, attackers exploited rounding in Linear Pools to manipulate rates. About $2.1M was lost across Ethereum, Optimism and Fantom, including Beethoven X pools. Balancer's own scope was about $980K on mainnet and $215K on Optimism.
Partly repaidBIP-445 set up a time-limited claims window for affected LPs instead of a full airdrop. Only LPs who came forward were refunded.Exploit$500K
Deflationary-token pool drained on Balancer v1
An attacker drained a v1 pool holding a deflationary token, whose balance shrank on each transfer in a way the pool's share accounting did not expect. About $500K was taken.
Repayment unknownWe found no primary record of reimbursement for this incident.
In our ratings
This page is the record. The scores sit on the review cards, next to the evidence and the weights they came from.
Compare Balancer with
Curve FinanceDEX · 2020 · SwitzerlandCurve Finance is the stablecoin-focused DEX behind crvUSD and the veCRV vote-lock model. Its pools were drained in the July 2023 Vyper compiler bug.
UniswapDEX · 2018 · United StatesUniswap is the automated market maker behind about $3.9 trillion of all-time DEX volume. Since December 2025 part of its swap fees buys and burns UNI.
PancakeSwapDEX · 2020PancakeSwap is the largest DEX on BNB Chain, trading about $28.6 billion a month. Up to 23% of each v3 swap fee buys and burns its CAKE token.
JupiterDEX · PanamaJupiter is Solana's main swap aggregator, routing about $15 billion a month across Solana DEXs. Half its on-chain revenue buys JUP for a trust.
Frequently asked questions
How much was stolen in the Balancer exploit?+
More than $128 million on 3 November 2025, across Ethereum and other chains. Rekt's tally was $128M. Some early reports cited about $110M while the count was still rising.
Did Balancer refund users after the hack?+
Only from rescued funds. About $8M saved by whitehats is claimable by the LPs of the pools it came from, and StakeWise handled about $19.7M in its own tokens. The DAO did not cover the remainder.
Is Balancer shutting down?+
Balancer Labs was wound down in March 2026. BIP-928, a DAO vote closing on 29 September 2026, would wind down the protocol itself, with pools moving to withdrawals only on 30 October 2026. At the time of checking it had passed quorum with no votes against.
Who are the Balancer Labs co-founders?+
Fernando Martinelli is the co-founder who wrote the March 2026 post announcing the shutdown of Balancer Labs.
What are Balancer weighted pools?+
Pools holding several tokens in fixed proportions other than 50/50, for example 80/20. Traders rebalance them back to target weights, and LPs earn the fees.
What changed
- Profile published.
Compiled by
Blockchain Security Researcher · September 27, 2026
We have no commercial relationship with Balancer and earn nothing from any link on this page. Every fact above carries the date it was true and a link to where it comes from; if one is out of date, the contact page reaches the editor who keeps this file.