The attack exploited vulnerabilities in smart contract interactions. This allowed an attacker to manipulate pool operations and drain funds in a matter of minutes.
Preliminary analysis by on-chain investigators indicates that a maliciously deployed contract exploited the vault’s initialization process, bypassing safeguards intended to prevent unauthorized swaps and balance manipulations. While the full forensic report is still pending from auditors like PeckShield and Nansen, early data shows that roughly $110–116 million in Ethereum and other assets were stolen.
How the Attack Worked in Balancer?
The breach leveraged Balancer’s composable design, where pools interact extensively, amplifying the vulnerability. Improper authorization and callback handling allowed the attacker to execute a sequence of rapid transactions, beginning with a key Ethereum mainnet transaction. Funds were subsequently funneled to a new wallet, likely for laundering through mixers or cross-chain bridges.
Here’s everything you need to know about the Balancer Hack:
1. The attack targeted Balancer’s V2 vaults and liquidity pools, exploiting a vulnerability in smart contract interactions. Preliminary analysis from on-chain investigators points to a maliciously deployed contract that… pic.twitter.com/udAM4hB0OD
— Adi (@AdiFlips) November 3, 2025
The main stolen assets included WETH, wstETH, osETH, frxETH, rsETH, and rETH, with the bulk of the losses, around $70 million, coming from Ethereum. Additional losses on Base and Sonic networks totaled $7 million, with other chains accounting for $2 million or more. This type of exploit highlights a recurring risk in AMMs and DeFi platforms, particularly involving deflationary tokens and complex pool rebalancing.
Absolutely insane — the total stolen funds from the Balancer exploit have now surged to $116.6M. 💀https://t.co/mZSf2EK7K5pic.twitter.com/yZIC6H9NB3
— Lookonchain (@lookonchain) November 3, 2025
Recommendations for Investors
Investors exposed to Balancer V2 pools should act quickly. Withdraw funds immediately if possible and avoid affected pools. Cancel any smart contract approvals linked to Balancer addresses using tools like Revoke, DeBank, or Etherscan to prevent further unauthorized interactions. Monitoring wallets via Etherscan or Dune Analytics can help detect suspicious activity in real time. Staying informed is crucial—follow updates from PeckShieldAlert, lookonchain, and Balancer’s official channels to track recovery efforts and forensic findings.
Audits and DeFi Security
Balancer had undergone over ten audits, with its V2 vault reviewed three separate times by different firms, yet it still suffered a $110 million hack. This incident highlights a harsh reality in decentralized finance: “audited by X” offers little guarantee.
balancer went through 10+ audits. the vault was audited 3 separate times by different firms
still got hacked for $110M
this space needs to accept that ‘audited by X’ means almost nothing. code is hard, defi is harder
it is unfortunate but hope the team recovers pic.twitter.com/nZzVzCdqDO
— Suhail Kakar (@SuhailKakar) November 3, 2025
Writing secure code is challenging, and building composable DeFi systems is even harder. While it is unfortunate for users and the protocol, there is hope that the Balancer team can recover and learn from this setback, reinforcing the importance of caution and continuous improvement in the rapidly evolving DeFi space.