Balancer, a decentralized finance (DeFi) protocol for automated market makers (AMMs) and liquidity pools, suffered a major security exploit today, with initial reports estimating losses at over $128 million in assets.
Sponsored
Subsequent updates from on-chain analysts like PeckShield and Nansen revised the total to approximately $128.64 million across multiple chains, including Ethereum, Berachain, Arbitrum, Base, Sonic, Optimism, and Polygon, as the attack is ongoing.
Earlier today, PeckShield reported that a flaw in swap and imbalance mechanics drained approximately $70 million in assets, including WETH, osETH, and wstETH.
The breach is believed to have stemmed from a faulty access control vulnerability in boosted pools, allowing unauthorized withdrawals from vaults.
According to X user Adi, the attack targeted Balancer’s V2 vaults and liquidity pools, exploiting a smart contract vulnerability that allowed unauthorized swaps and rapid asset drainage across interconnected pools.
The exploiter funneled million in assets, including WETH, wstETH, and osETH, through a series of transactions starting on Ethereum mainnet, consolidating funds likely for laundering via mixers or bridges.
As of the latest reports, Balancer’s team has not issued an official statement, and the exploiter is consolidating funds, raising concerns about potential laundering.
This is Balancer’s third major security incident since 2020. It follows a $500,000 flash loan exploit in 2020 and a $238,000 DNS phishing attack in 2023.
Why This Matters
DeFi platforms like Balancer remain vulnerable to major exploits, putting user funds and trust in the ecosystem at serious risk.
Discover DailyCoin’s trending crypto scoops:
$2.3B Exodus Hits MEXC Amid Insolvency Fears
How Israel Became a Global Hub for Blockchain Innovation
People Also Ask:
The exploit was caused by a faulty access control vulnerability in boosted pools, allowing unauthorized withdrawals from vaults.
A vulnerability in Balancer’s boosted pools allowed an attacker to withdraw funds without authorization, resulting in losses of around $128 million.
The breach exploited faulty access controls in the protocol’s smart contracts, particularly in pools designed to boost rewards for liquidity providers.
