Balancer official statement confirms the hack is limited to V2 pools which have all been paused where possible, and to beware of fraudulent messages from unofficial sources

Balancer has confirmed that the major November 3, 2025 exploit is confined to its V2 Composable Stable Pools, and that affected V2 pools have been paused wherever technically possible, while warning users to ignore unofficial communications and potential phishing attempts. The incident saw attackers exploit a long‑standing rounding/precision bug in Balancer’s V2 vault logic to manipulate pool invariants and Balancer Pool Token (BPT) pricing, enabling them to drain more than $120–$128 million in assets across multiple chains in a series of highly engineered swap transactions. The vulnerability lay in how Balancer V2’s stable pool math handled scaling and invariant calculations: a rounding‑direction inconsistency and precision loss in functions such as upscale/upscaleArray allowed carefully crafted batch swaps to repeatedly harvest value by deflating the implied BPT price. The attacker executed sequences of micro‑swaps and pool state changes that compounded these rounding errors, then withdrew accumulated balances via Balancer’s internal accounting, impacting deployments on Ethereum and several L2s and affecting both Balancer and protocol forks. Security firms including OpenZeppelin, BlockSec, Check Point, Trail of Bits, and others have since confirmed the root cause, and Balancer and auditors have emphasized that Balancer V3 is not affected by this specific bug, while the team coordinates with researchers, monitors on‑chain activity, and urges users to rely only on official channels to avoid scams piggybacking on the incident.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Balancer V2 Stable Pools Exploit — Rate Manipulation - Coinspect (coinspect.com)
• Balancer Exploit Explained: What Went Wrong and Why v3 Is Safe (certora.com)
• Understanding the Balancer v2 Exploit - OpenZeppelin (openzeppelin.com)
• Comprehensive Analysis of the $128 Million Balancer V2 DeFi Exploit (rescana.com)
• In-Depth Analysis: The Balancer V2 Exploit - BlockSec Blog (blocksec.com)

Explore the topic

• Hacks
• Balancer