Over $100M in Crypto Drained From Balancer Pools, Team Confirms Ongoing Investigation

Decentralized finance protocol Balancer is facing what appears to be a major security incident, after onchain data showed large, irregular outflows from several of its vaults.

Early estimates from blockchain security firms point to more than $128 million in crypto assets to have been drained.

Onchain activity flags massive asset movement

One of the first alerts came from Nansen and PeckShield. Data from Etherscan shows a series of high-value transfers from Balancer’s main vault contract (0xBA1…BF2C8) to an unknown external wallet.

The outgoing assets included roughly 6,587 WETH ($24.5M), 6,851 osETH ($26.9M), and 4,260 wstETH ($19.3M), with additional transactions across other chains suggesting a coordinated exploit rather than routine withdrawals.

Balancer later acknowledged the issue on X, stating it was “aware of a potential exploit impacting Balancer v2 pools” and that its engineering and security teams were working on the matter “with high priority.” No official post-mortem or recovery plan has yet been shared.

Security analysts, including Trading Strategy CEO Mikko Ohtamaa, suggested the issue may stem from a flawed smart contract validation check affecting Balancer v2 deployments and possibly its forks. PeckShield added that the exploit appeared to be happening across multiple networks where Balancer is deployed, not only Ethereum.

As news spread, the platform’s token BAL dropped nearly 10% in 24 hours, trading near $0.90 at the time of writing. A whale wallet dormant for three years also rushed to withdraw $6.5 million, according to Lookonchain, signaling rising user concern.

Berachain responds with network halt to protect user funds

The impact of the exploit extended beyond Balancer itself. Berachain, a Cosmos-based Layer 1 that integrates Balancer v2 code in its native DEX, paused block production to prevent further losses while developers prepared a hard fork to restore affected funds.

The team described the halt as intentional, explaining that the attack had compromised liquidity pools such as the Ethena/Honey tripool, putting roughly $12 million in user deposits at risk. “The network will be operational shortly upon recovering all affected funds,” Berachain said.

The decision sparked a familiar debate in crypto: whether user protection should outweigh ideological decentralization.

Onchain sleuth ZachXBT and influencer DeFi Ignas publicly backed Berachain, arguing that halting a chain in an emergency is preferable to allowing irreversible losses. “There’s nothing to gain pretending decentralization here,” Ignas wrote.

Balancer, founded in 2020, remains one of the larger Ethereum-based automated portfolio managers, with more than $350M in TVL prior to the incident. The full scope of the exploit, and whether user funds can be recovered, remains unclear pending an official Balancer update.

Other Related Read/Listens

• Bybit Reports 27.59% of Stolen Funds From $1.4B Hack Are No Longer Traceable
• MEXC Unfreezes User $3.1M After Public Backlash, But Is a Bigger Crisis Looming?
• Hackers Strike Odin.fun, Draining $7M in Price Manipulation Attack