After a $116M Balancer exploit rippled across chains, Berachain validators voted to halt the entire network — raising hard questions about whether “decentralization” still means what it used to.

In early November 2025, Balancer V2 suffered a major smart‑contract exploit that drained more than $110–116 million in assets across multiple chains, including Ethereum mainnet and networks that had deployed or forked its V2 composable stable pools. The attacker abused a logic flaw in Balancer’s V2 vault contracts—specifically around manageUserBalance/_validateUserBalanceOp and batch swap arithmetic/rounding—allowing unauthorized withdrawals from shared liquidity pools, with losses escalating from roughly $70 million to over $116 million within hours. Assets taken included large amounts of wrapped and staked ETH derivatives such as WETH, wstETH, osETH, frxETH, rsETH, and rETH. Because Balancer V2 code and pools were deployed or forked on other networks, the exploit’s impact rippled across chains. On Berachain, where Balancer-based assets were hosted, validators responded by halting the Berachain network to apply an emergency update, with the Berachain Foundation signaling that a hard fork would be used to help Balancer resume operations and recover funds. Gnosis Chain operators adopted a similar approach: they initially implemented a soft fork and subsequently executed a hard fork to pull roughly $116 million in exploited Balancer-related funds out of the attacker’s control so they could be managed by the community. These coordinated validator actions—effectively reversing or redirecting exploit flows at the protocol level—have sparked debate about how “decentralized” networks really are when a relatively small set of validators can pause execution or rewrite state to intervene in application‑level incidents. The Balancer incident has also had lasting consequences for the project itself. Balancer Labs, the core development team, announced it would wind down after the exploit, with control over the protocol transitioning to the Balancer Foundation and the DAO amid a sharp drop in total value locked and BAL token performance. Security firms and commentators have highlighted the episode as a case study in the limits of audits and the systemic risk posed by shared‑vault architectures and widely forked DeFi code. The combination of a large, multi‑chain loss; chain‑level forks to recover funds; and the shutdown of the founding development company has turned the Balancer exploit and the subsequent Berachain/Gnosis validator interventions into a central reference point in ongoing discussions about DeFi security, social consensus, and the practical meaning of decentralization.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Balancer Data Breach: $116M Hack Exposes Smart Contract Flaw (thecyberexpress.com)
• Gnosis Recovers $116M From Balancer Hack Through Hard Fork (coinmarketcap.com)
• DeFi Protocol Balancer Exploited for $116M - Coinspaid Media (coinspaidmedia.com)
• Balancer's $128 Million Exploit — What Really Happened? - CCN.com (ccn.com)
• Rounding Errors Cost $116M: The Tiny Flaw That Broke Balancer ... (binance.com)

Explore the topic

• Berachain
• Decentralization
• Exploit
• Balancer