$128M exploit on Balancer V2 reveals how a rounding error slipped past 11 audits from firms like OpenZeppelin, Certora and many more

On 3 November 2025, Balancer’s V2 Composable Stable Pools were hit by a highly technical exploit that drained roughly $128–129 million in assets across multiple chains, despite the protocol having undergone at least 11 audits by firms including OpenZeppelin, Trail of Bits, Certora and ABKD. The attacker targeted a subtle rounding/precision error in Balancer V2’s scaling and invariant math (notably in the _upscaleArray / _upscale logic used for Composable Stable Pools), then amplified that tiny bias through carefully engineered batch swaps and micro-swaps, allowing pool prices and Balancer Pool Token (BPT) values to be manipulated and liquidity to be siphoned out at scale.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Comprehensive Analysis of the $128 Million Balancer V2 DeFi Exploit (rescana.com)
• How an Attacker Drained $128M from Balancer Through Rounding ... (research.checkpoint.com)
• Balancer DeFi protocol loses over $128M in crypto heist - SC Media (scworld.com)
• Balancer - Rekt II (rekt.news)
• How The $128m Balancer Exploit Happened - by Harry Donnelly (harrydonnelly.substack.com)

Explore the topic

• Audit
• Balancer