Tiny Bug, Huge Loss: $100M+ Balancer Exploit Rocks DeFi

A tiny rounding bug in Balancer’s code led to a massive $100M DeFi exploit, exposing critical flaws in smart contract security.

The decentralized finance (DeFi) protocol Balancer has suffered a catastrophic exploit that led to over $100 million in stolen digital assets, marking one of the largest DeFi breaches of 2025.

The attack, reported in November, 2025, exploited a subtle rounding-error vulnerability within Balancer’s V2 Composable Stable Pools, allowing attackers to drain funds through repeated micro-gains across thousands of transactions.

The attackers leveraged a rounding-down flaw in Balancer’s internal swap calculation logic, specifically within its batchSwap function.

Each transaction’s token swap produced a minuscule discrepancy due to rounding behavior, but when executed in rapid succession across multiple pools, the imbalance compounded into millions in losses.

In simple terms, the exploit allowed hackers to harvest fractions of tokens that should have been discarded during calculations.

Over time, those small discrepancies accumulated into significant stolen amounts.

This sort of reminds me of what they tried with rounding banking transactions in the IT cult classic movie Office Space .

Blockchain forensics indicate the attack spanned several chains, including Ethereum, Polygon, and Base, targeting vaults tied to osETH , WETH , and wstETH tokens.

Further investigation by Decurity , a blockchain security firm, revealed that a faulty access control in the manageUserBalance function contributed to the attack.

A logic flaw in the validateUserBalanceOp process failed to properly verify message senders, allowing unauthorized withdrawals via the UserBalanceOpKind.WITHDRAW_INTERNAL operation.

This gave attackers a direct pathway to siphon funds from Balancer’s core vaults.

Despite undergoing multiple independent audits since 2021, this specific economic logic vulnerability went undetected — underscoring a persistent issue within DeFi where traditional code audits can miss logic-based or chained operation exploits.

The total losses are estimated at over $100 million, with the stolen assets now consolidated across several wallets, prompting concerns potential money laundering through decentralized mixers and cross-chain bridges.

The incident affected only V2 Composable Stable Pools, while V3 and other Balancer versions remain operational and secure.

Nonetheless, forked projects built on top of Balancer — such as Beets Finance — reported secondary impacts exceeding $3 million.

Following the breach, Balancer immediately paused affected pools and initiated a forensic investigation with blockchain analytics firms to trace the stolen assets.

The team confirmed that impacted users have been notified and that no vulnerabilities were detected in the newer protocol versions.

Phishing campaigns also emerged in the hours following the exploit.

Fraudulent accounts posing as Balancer representatives offered fake “white-hat bounty” programs, claiming the hacker could keep 20% of the stolen funds for returning the rest.

These scams attempted to lure victims into secondary theft schemes, exploiting panic in the DeFi community.

The Balancer exploit demonstrates once again that even minor code oversights can have devastating financial consequences in decentralized systems.

According to ClearPhish, the incident reinforces three key lessons for DeFi developers and investors alike:

This is the third major security incident since 2021, and it highlights systemic challenges in the DeFi ecosystem.

While composable architectures enable innovation and interoperability, they also create complex dependency chains where one logic flaw can ripple across multiple protocols.

The incident further exposes the limitations of current smart contract auditing practices.

Static analysis tools are effective for detecting syntax and memory vulnerabilities but often fail to simulate multi-transaction, multi-pool behaviors — the very mechanisms that attackers exploit.

Moving forward, DeFi projects must invest in dynamic defense strategies, including:

The Balancer exploit underscores a painful truth for decentralized finance: even well-audited, battle-tested protocols can harbor exploitable weaknesses.

As DeFi continues to mature, its security model must evolve from static prevention to adaptive, continuous protection.

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.

A critical React Native flaw exposes millions of developers to remote code attacks.

European authorities dismantled a €600 million crypto fraud network in a coordinated international operation.

Researchers found Microsoft Teams bugs letting attackers spoof executives, alter messages, and erode trust in workplace communication.

Apple’s iOS 26.1 and iPadOS 26.1 updates fix major security bugs in WebKit, Kernel, and privacy features. Update now to stay protected.