Balancer V1 (BPool rounding) hack — August 2026

A legacy Balancer V1 pool lost about $234,000 on 31 August 2026 to a rounding error in its fixed-point arithmetic. The attacker used flash loans to push the pool's wrapped bitcoin reserve close to zero, and at that point the 18-decimal maths in the join path rounded so badly that a single satoshi of input minted 4,408.8 pool tokens. The flaw sat in the functions handling a single-asset join and the pool-token calculation behind it.

SlowMist noted that the pool lacked the safeguards that would have stopped this: a minimum effective input, a minimum pool balance, and validation of relative error. The contract did carry a minimum-balance check, but it was enforced only when assets were bound or rebound to the pool, not during ordinary swaps.

The amount is small; the reason it is recorded is that the code is unmaintained and widely forked. Balancer Labs wound down as a company earlier in 2026 following the much larger V2 exploit recorded elsewhere in this registry, and the V1 contracts have no maintainer. Balancer warned users that the legacy contracts put liquidity provider funds at risk. Forks running the same code remain exposed, and this entry exists partly so that the second occurrence of a bug family is on the record alongside the first.