What happened
On November 3, 2025, attackers exploited rounding errors in Balancer V2 Composable Stable Pools. Balancer's post-mortem reports $121.1 million in losses; Check Point estimates $128.64 million across six networks. These estimates should not be treated as interchangeable.
Balancer's separate $45.7 million protected-or-recovered figure includes funds prevented from being stolen, so it is not a reimbursement total.
In _swapGivenOut, scaling rounded the output amount down before StableMath calculated the input, allowing underpayment. Rate-provider imprecision, low liquidity and BPT composability made the error exploitable. The internal-balance feature was used for extraction but did not cause the vulnerability.
How it happened
- The attacker used BPT exit-swaps to reduce vulnerable pool liquidity and amplify rounding errors.
- Exact-out swaps calculated insufficient input for the requested output.
- Repeated swaps reduced the invariant and BPT value, leaving surplus assets after settlement.
- Funds accumulated in Vault internal balances and were subsequently withdrawn.
- Responders paused vulnerable V6 pools, activated recovery mode and conducted rescue operations.
Protocol details
Security review history
- OpenZeppelin View report
- Trail of Bits View report
Funds Recovery
Recovered
$48.8M
Net Loss
$79,232,000
Post-Incident Timeline
-
2025-11-28
Total Recovered: ~$48.8 million StakeWise Recovery: $20.7 million Berachain Full Recovery: $12.8 million White-hat and Internal Recoveries: ~$8 million Additional MEV Bot Recoveries: $750,000+
Evidence
- report @lookonchain incident report x.com
- report @PeckShieldAlert incident report x.com
- report @De_FiSecurity incident report x.com
- report @adiflips incident report x.com
- report Nov 3 Exploit Post-Mortem medium.com
- analysis DeFiLlama defillama.com
- analysis How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation research.checkpoint.com
- analysis Understanding the Balancer v2 Exploit: Technical Analysis and Lessons for the Blockchain Industry openzeppelin.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
