Balancer DEX Exploited: Over $116 Million in Digital Assets Stolen
The decentralized exchange (DEX) and automated market maker (AMM) Balancer has suffered a major exploit, resulting in more than $116 million in digital assets being transferred to a newly created wallet.
Ongoing Investigation
Balancer’s team confirmed the incident via social media, stating:
“We’re aware of a potential exploit impacting Balancer v2 pools. Our engineering and security teams are investigating with high priority.”
Early on-chain data revealed that the attack initially involved $70.9 million worth of liquid staked Ether tokens, moved in three transactions according to Etherscan logs. Crypto intelligence platform Nansen reported the transfer of 6,850 StakeWise Staked ETH (OSETH), 6,590 Wrapped Ether (WETH), and 4,260 Lido wstETH (wSTETH).
By Monday morning, the total stolen amount had reportedly increased to over $116.6 million, according to Lookonchain. Research analyst Nicolai Sondergaard explained:
“From what I see, losses are now greater than $100 million and have affected Balancer v2 + various forks.”
The exploit appears to stem from a smart contract vulnerability involving a faulty access check that allowed the attacker to withdraw funds without authorization.
White Hat Bounty and Recovery Efforts
In response, Balancer offered a white hat bounty of up to 20% of the stolen funds if returned immediately, while promising continued cooperation with blockchain forensics specialists and law enforcement should the funds not be returned within 48 hours. The protocol noted:
“Our partners have a high degree of confidence you will be identified from access-log metadata… indicating connections from a defined set of IP addresses/ASNs and associated ingress timestamps that correlate with the transaction activity on chain.”
This is not Balancer’s first security issue. In 2021, a DNS attack redirected users to a phishing site, resulting in $238,000 in stolen assets. In 2023, the protocol suffered a $1 million stalecoin exploit, and in 2020, a flash loan attack led to $500,000 in losses.
