Balancer has published its preliminary report detailing the attack that impacted the DeFi protocol on November 3. A technical flaw within its V2 pools enabled hackers to siphon $128 million across seven different blockchains. However, the true financial impact is considerably higher, with the total value locked (TVL) plummeting by 58% in just two days. This raises questions about how a protocol that underwent eleven security audits could fall victim to such a significant event.
In brief
- •Balancer lost $128 million on November 3 due to a rounding error in its V2 pools.
- •The protocol’s TVL collapsed by 58%, falling from $443 million to $186 million in two days.
- •Seven blockchains were affected, with Ethereum accounting for $99 million in losses.
- •Ethical hacker teams have recovered $33 million so far.
A Microscopic Flaw with Devastating Consequences
On November 3, 2025, Balancer joined the ranks of DeFi protocols that have fallen victim to massive hacks. The cause was identified as a simple rounding error present in the "composable stable V2 pools."
This vulnerability provided attackers with a clear pathway to manipulate batch swaps and systematically drain liquidity from the protocol.
Ethereum experienced the most significant impact, with $99 million stolen. Following this, attackers targeted Base, Polygon, Arbitrum, Optimism, Sonic, and Avalanche. Their strategy involved exploiting batch swaps to falsify balance calculations and extract value before the system could detect the anomaly.
Balancer's response was prompt. The team suspended the affected pools minutes after the flaw was detected, which helped to mitigate further losses. Crucially, the V3 pools remained unaffected, underscoring the robustness of the protocol's newer infrastructure.
Recovery efforts are ongoing. Ethical hackers have successfully retrieved $33 million to date. Berachain executed a hard fork and recovered $12.8 million, with reimbursements already in progress.
StakeWise managed to secure $20 million through its internal operations. The protocol commended the swift action taken, stating it "prevented a larger hemorrhage." A comprehensive report is expected soon, outlining the steps for affected users to recover their funds.
The Collapse of Trust Costs More Than the Hack
The figures concerning Balancer's TVL paint an even more concerning picture. The protocol's total locked value experienced a dramatic decline, dropping from $443 million on November 3 to just $186 million at present. This represents a staggering 58% decrease within a forty-eight-hour period.
This sharp decline erases months of relative stability. Balancer had already been experiencing a downward trend in its TVL since January 2025, having lost over a billion dollars. The recent hack has significantly accelerated this decline and instilled fear among investors. When combining the direct theft and the subsequent capital flight, the total loss now exceeds $257 million.
The BAL token saw an initial 6% drop before stabilizing. Traders quickly recognized the resilience of the protocol's V3 version. This price resistance, which proved stronger than the TVL's performance, suggests a degree of market confidence in Balancer's ability to recover.
The protocol is now actively encouraging an aggressive migration to V3. The team has also issued warnings against fraudulent communications that exploit the post-hack confusion. Further audits and code enhancements are planned to prevent a recurrence of this incident.
This $128 million hack positions Balancer as the second-largest DeFi hack of 2025, contributing to the ecosystem's annual loss mark of over $2.2 billion.
This event serves as a stark reminder that despite its promises of transparency and security, Decentralized Finance (DeFi) remains a high-risk environment. Composability, a fundamental principle that allows protocols to integrate like building blocks, has demonstrated its vulnerability: when one component fails, the entire system can be jeopardized.