Balancer Hacked AGAIN, Over $128M Stolen: Will Ethereum Layer-2s Shut Down?
Unfortunately, crypto hacks happen all the time. Every time funds are stolen from a top-tier dApp, it becomes a huge morale dent for users and developers.
The Bybit hack garnered negative press but subsided quickly when the exchange assured the community that it would continue processing transactions regardless of the $1.3 billion loss. Today, however, is yet another sad day for Balancer and DeFi.
Earlier today, Balancer, one of the OG DeFi protocols, was hit (again), and the results are bad, not for the dapp but for the entire DeFi scene and Ethereum layer-2s. Before today, Balancer over $775 million, but the protocol is quickly bleeding.
We’re aware of a potential exploit impacting Balancer v2 pools.
Our engineering and security teams are investigating with high priority.
We’ll share verified updates and next steps as soon as we have more information.
— Balancer (@Balancer)
DISCOVER:
Balancer Hack: Over $120M And Rising Lost
To understand what’s going on, we must first know what Balancer does.
For beginners, Balancer is a decentralized automated market maker (AMM) protocol on Ethereum. From the dapp, developers on other can also build programmable liquidity solutions.
That you can fork Balancer V2’s code is a bonus. If you don’t have liquidity, you can supply assets and allow users to trade them while earning a yield from any custom liquidity pool straight from Balancer.
But here’s the problem: Balancer only relied on a single core contract to manage all vaults. The design was intended to boost gas efficiency, but this became the single largest flaw, now affecting not only Balancer but also all other deployments that relied on its code.
Here's everything you need to know about the Balancer Hack:
1. The attack targeted Balancer's V2 vaults and liquidity pools, exploiting a vulnerability in smart contract interactions. Preliminary analysis from on-chain investigators points to a maliciously deployed contract that…
— Adi (@AdiFlips)
The hacker targeted the “manageUserBalance” function, effectively taking over vault withdrawals while bypassing sender validation. So far, over $128 million have been drained from vaults across multiple chains, including Berachain.
Update: and its forks are under attack, with total losses across multiple chains reaching ~$128.64M so far.
— PeckShieldAlert (@PeckShieldAlert)
The loss will likely grow because after the hacker drained Balancer pools on Ethereum, the layer-1, the next targets were bridged equivalents on layer-2s, that is, wrapped tokens. What this is creating is a “domino effect” where a protocol using Balancer v2 code, especially if it’s a layer-2, has to pause operations until the flaw has been fixed.
Balancer v2 (+forks) exploited for over $100M+TLDR:
Balancer v2 and it's forks are affected: • ETH → balancer → 70m • Arbitrum → balancer → 6m • Base → balancer → 4m • → beets → 3.4m • OP → beets → 283k • Polygon → balancer → 117k
Exploiter is…
— Blub (@DeFi_Blub)
DISCOVER:
Berachain Halts Chain
Out of caution, Berachain, which is supposed to mirror the Ethereum mainnet and run 24/7, has been paused.
In a post on X, the team said its validators have “coordinated” purposefully to halt the platform as they scramble to perform an emergency hard fork in order to address the Balancer hack.
The Berachain validators have coordinated to purposefully halt the Berachain network as the core team performs an emergency hard fork to address Balancer V2 related exploits on the BEX.
This halt has been executed purposefully, and the network will be operational shortly upon…
— Berachain Foundation (@berachain)
They are also aware that some may not be happy, but their primary objective is to protect .
Beefy, a yield optimizer, has also paused all products linked to Balancer.
Balancer V2 Exploit:
All Beefy Balancer V2 products are paused. Our team is monitoring the situation closely.
We will cooperate to ensure all losses are properly captured, and that Beefy users participate fully in any recovery.
Our full support to the team.
— Beefy (@beefyfinance)
They also promise to cooperate and ensure that all losses are properly accounted for.
The question now is: Will other protocols, most of them being DEXes, follow suit? On Beets DEX, there are over $6.6M in total value locked (TVL), for instance, and this is just one of the over 20 platforms that have forked Balancer V2’s code.
(@DeFi_Blub) 
(@berachain) 
