Incident Overview
On November 3, 2025, Beets Fi protocol on Sonic Labs suffered an exploit targeting Balancer V2 pools. Sonic's security team responded by deploying an emergency safety mechanism that froze two suspected attacker wallets, with $3M worth of USD on their balance. Two Balancer V2 pools (stS/S and stS/wOS) were impacted, while V3 pools and the stS LST token remained unaffected.
The attack targeted two specific Balancer V2 pools on the Beets DEX: the stS/S pool and the stS/wOS pool. The exploit appears related to the broader Balancer V2 vulnerability disclosed around the same timeframe affecting multiple chains. Upon detection of suspicious activity, Sonic Labs' security team took swift action by deploying a previously planned safety mechanism ahead of its scheduled network upgrade, enabling them to freeze suspected attacker wallets and prevent further fund movement.
The stS liquid staking token (LST) continued operating normally with minting, staking, and unstaking functions unaffected. All Beets V3 pools remained secure and operational throughout the incident. The rapid coordination between Beets and Sonic Labs allowed for containment before the attacker could extract funds from the Sonic network.
Incident Report
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Beets, these are the critical security checks that could have prevented this incident (November 2025).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
Learn to Prevent the Next Beets
The Beets hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.