Balancer Releases Preliminary Report On Its $128M Exploit, Finds Rounding Error In Bulk Exchange Transactions
John: Hey everyone, I’m John, your go-to tech blogger at Blockchain Bulletin, where I break down the latest in Web3, metaverse, and blockchain news. Today, we’re diving into Balancer’s recent exploit involving a $128 million loss, and their preliminary report that points to a rounding error in bulk exchange transactions. If you’d like a simple starter guide to exchanges, take a look at this beginner-friendly overview.
Lila: Hi John, readers are probably wondering how a big DeFi protocol like Balancer got hit so hard. Can you start by explaining what Balancer is and what this exploit is all about?
What is Balancer and the Basics of the Exploit
John: Sure, Lila. Balancer is a decentralized finance (DeFi) protocol that lets users create and manage liquidity pools for trading cryptocurrencies on blockchains like Ethereum. In the past, on 2025-11-04, attackers exploited a vulnerability in Balancer’s V2 version, draining about $128 million from certain pools across multiple chains.
Lila: DeFi? That’s decentralized finance, right? But what made this exploit possible?
John: Exactly, DeFi means financial services built on blockchain without traditional banks. This exploit happened due to a flaw in how Balancer handled batch swaps—those are bulk exchange transactions where multiple trades happen in one go to save on gas fees (that’s the cost of executing transactions on the blockchain).
Details from the Preliminary Report
Lila: So, Balancer released a preliminary report. What does it say happened?
John: According to the report released on 2025-11-05, the root cause was a rounding error in the EXACT_OUT function within batchSwap. When the scaling factor for assets wasn’t a whole number, the system rounded down, letting attackers manipulate pool balances and withdraw more than they should.
Lila: Rounding error sounds simple— like in math class. How did that lead to such a big loss?
John: It’s a precision issue in the smart contract code. Attackers could repeatedly exploit this tiny discrepancy to siphon funds, and it only affected V2’s composable stable pools—these are pools designed for stablecoins with flexible compositions. Currently, Balancer has confirmed that V3 pools and other types weren’t impacted.
How the Rounding Error Worked in Bulk Transactions
Lila: Can you break down how this rounding error played out in those bulk exchanges?
John: Imagine you’re swapping tokens in a pool, and the math involves scaling factors—like multiplying by 1.0001 or something non-integer. The code rounded down the amounts, creating a loophole where attackers could input trades that effectively stole tiny bits repeatedly, adding up to millions. This was spotted in transactions on chains like Ethereum and Arbitrum.
Lila: That makes sense for beginners. Were there any warning signs before this?
John: In the past, Balancer has faced exploits, like one in 2023 involving deflationary tokens, but this was different. The report notes that security partners detected suspicious activity quickly on 2025-11-04, allowing for rapid response.
Impact on Chains and Total Value Locked
Lila: Which chains were hit, and how bad was the damage?
John: The exploit affected pools on Ethereum, Base, Avalanche, Polygon, and Arbitrum. It led to a 58% drop in Balancer’s total value locked (TVL), which is the amount of assets in the protocol, from around $220 million to about $92 million as of 2025-11-06.
Lila: Wow, that’s a huge hit. What kinds of assets were stolen?
John: Assets like 6,587 WETH (worth $24.5 million), 6,851 osETH ($26.9 million), and 4,260 wstETH ($19.3 million) were withdrawn, based on transaction data from sources like Etherscan. Remember, TVL can fluctuate, so check current figures on official dashboards.
Recovery Efforts and Safeguards
Lila: Is Balancer doing anything to recover the funds?
John: Yes, currently, the team is working with white-hat hackers and security firms. They’ve recovered some assets through measures like automatic pool suspensions and freezing funds. For example, partners like Hypernative helped pause vulnerable pools quickly.
Lila: What can users do to stay safe in DeFi?
John: Here’s a quick list of tips:
- Always verify pool details on official sites before depositing.
- Use hardware wallets for large amounts to add security layers.
- Monitor for protocol updates and avoid high-risk pools during incidents.
- Don’t invest more than you can afford to lose, as DeFi involves smart contract risks.
John: Also, compliance varies by jurisdiction—always check local regulations and official docs for the latest.
Lessons Learned and Builder Tips
Lila: What lessons can the crypto community take from this?
John: This highlights the importance of rigorous code audits, especially for math-heavy functions like rounding in swaps. In the past, similar precision errors have hit other protocols, so builders should test non-integer scenarios thoroughly.
Lila: Any tips for developers building similar systems?
John: Absolutely—use libraries with built-in safe math functions, conduct multiple audits, and simulate exploits in test environments. (And hey, if math errors can cause $128 million drama, imagine what they do to your grocery bill—okay, bad joke, but stay vigilant!)
Looking Ahead for Balancer
Lila: What’s next for Balancer after this?
John: Looking ahead, Balancer plans to patch the V2 vulnerability and continue recovery. They’re encouraging affected users to check their site for compensation details, and V3 remains secure for ongoing use.
Lila: Will this change how people view DeFi security?
John: It might push for better standards, but DeFi has bounced back from bigger hits before. Stay informed via trusted sources.
John: Wrapping up, this exploit shows how even small code flaws can have big impacts in blockchain, but Balancer’s quick response is a positive sign for the space. It’s a reminder to approach DeFi with caution and knowledge. And if you’d like a bit more background on exchanges, you might enjoy this global guide.
Lila: Thanks, John—that clears up a lot. Key takeaway: always double-check the tech behind your crypto moves!
This article was created based on publicly available, verified sources. References:
- Original Source
- Balancer identifies rounding error as root cause of multi-chain DeFi exploit | The Block
- Balancer releases preliminary report on v2 vulnerability incident: A rounding logic error in bulk exchange transactions was exploited. – Odaily
- Balancer reveals $128M hack details: V2 rounding error triggers 58% TVL collapse – AMBCrypto
- Tiny Rounding Error Ignites Balancer’s $128M Multi-Chain Exploit