Balancer reveals $128M hack details: V2 rounding error triggers 58% TVL collapse

Key Takeaways

What caused the Balancer exploit?

A rounding error in V2 Composable Stable Pools allowed attackers to manipulate batch swaps and drain $128 million across seven blockchains, 

How much did Balancer’s TVL drop after the hack?

TVL crashed 58% from $443 million to $186 million, resulting in a total loss of $257 million.

Balancer released its preliminary exploit report on 5 November, confirming that a rounding error in V2 Composable Stable Pools enabled the $128 million hack that struck 3 November. 

The technical vulnerability allowed attackers to manipulate batch swaps and drain liquidity across seven blockchains.

Recovery efforts underway

White-hat teams recovered $33 million so far. Berachain executed a hard fork and clawed back $12.8 million, already beginning user repayments. 

StakeWise reclaimed $20 million through its own recovery operations.

Balancer praised the “speed that stopped a bigger bleed,” noting the team contained the attack and protected most of the platform. 

A comprehensive post-mortem report is forthcoming, including detailed recovery steps for affected V2 pool users.

The Balancer attack breakdown

Attackers hit Ethereum hardest, siphoning $99 million from the network. They also exploited pools on Base, Polygon, Arbitrum, Optimism, Sonic, and Avalanche, using batch swap manipulation to distort pool balances and extract value.

Balancer paused vulnerable pools within minutes of detection and froze additional damage. V3 pools stayed completely untouched throughout the attack, validating the protocol’s newer infrastructure.

The exploit ranks as 2025’s second-largest DeFi hack, pushing yearly losses across the ecosystem past $2.2 billion.

TVL devastation exceeds hack damage

The real story emerged in the TVL data. Balancer’s Total Value Locked collapsed from $442.96 million on 3 November to just $186.09 million today—a brutal 58% drop in two days.

Source: DefiLlama

The TVL chart shows a dramatic cliff dive marking the exploit, erasing months of relative stability around $450-600 million. Balancer had already declined from over $1 billion in January 2025, and the hack accelerated the downward trend.

Market and migration response

The BAL token dipped 6% following the exploit but stabilized as traders recognized V3’s resilience. The token held better than TVL, suggesting market confidence in Balancer’s ability to recover through migration.

Balancer now promotes aggressive V3 migration and warns users against scam messages that exploit the situation.

The team committed to code upgrades and deeper audits to prevent similar vulnerabilities.