3 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
Balancer reported that a rounding error in its swap logic led to a major exploit on November 3, draining over $128 million from its Composable Stable Pools across various networks. The flaw allowed attackers to manipulate pool balances and extract funds before emergency measures were implemented to contain the damage.
If you do, here's more
Balancer experienced a significant exploit on November 3, draining over $128 million from its Composable Stable Pools across multiple networks, including Ethereum and Avalanche. The root cause was identified as a rounding error in the swap logic of its v2 vault. Attackers took advantage of this flaw, which allowed them to manipulate pool balances and extract funds by exploiting how deferred settlement was handled in composable pools. The bug primarily impacted older versions of the Composable Stable Pools while newer versions remained secure.
Following the exploit, Balancer's security partner, Hypernative, detected suspicious activities early on. Various contributors, including SEAL 911 and BitFinding, assisted in mitigating the damage. Emergency measures were implemented across affected networks, with StakeWise recovering approximately $19 million in stolen assets. Berachain halted its network for an emergency hard fork to address vulnerabilities, while Sonic Labs froze suspected attacker addresses. Gnosis restricted bridge activities to prevent further asset movement.
While some funds were recovered or frozen, Balancer emphasized that loss figures remain unverified until final reconciliations are completed. The incident highlights vulnerabilities in multi-chain DeFi protocols and underscores the necessity for robust security measures to prevent similar exploits in the future.
Questions about this article
No questions yet.