Balancer V2 hack — November 2025

Balancer's V2 vault was drained on 3 November 2025, beginning at 07:46 UTC, in a coordinated multi-chain attack on its legacy Composable Stable Pools.

The defect was arithmetic, not a broken permission check. Composable Stable Pools and Linear Pools override the vault's scaling factors to fold in a non-unitary token exchange rate, and the upscaling routine rounds down when applying them. By first pushing pools into very low-liquidity states, the attacker made swap amounts small relative to those scaling factors, so each truncation was large in relative terms. Bundling dozens of EXACT_OUT swaps into single batchSwap calls compounded the error, suppressing the pool invariant and with it the pool token price, allowing the attacker to buy out the pool cheaply. Proceeds first accumulated as vault internal balances and were withdrawn in later transactions.

Estimates diverge. Balancer's post-mortem describes an estimated $94.8 million theft of user funds and $121.1 million in total losses across Ethereum, Arbitrum, Base, Optimism and Polygon, of which about $45.7 million was protected or recovered, leaving roughly $75.4 million with the attacker. Check Point Research, monitoring on-chain, measured $128.64 million drained across six blockchain networks in under 30 minutes; crypto.news reported the affected set as Ethereum, Arbitrum, Base, Optimism, Polygon, Sonic and Berachain, the last two running Balancer forks.

Recoveries included about $20.9 million of osETH and osGNO secured by the StakeWise DAO multisig, $4.6 million taken back by white-hats under the SEAL Safe Harbor agreement, and $19.3 million protected by emergency pool pauses. Berachain validators halted their chain and executed a hard fork, recovering its $12.8 million in full.