What happened
On November 3, 2025, the Balancer V2 Stable Pool precision-loss bug that hit Balancer across several chains was also used against Beets, a Balancer V2 fork on Sonic. The attacker took about $3 million worth of Beets Staked Sonic (stS) from two affected Beets V2 pools.
Sonic Labs pushed an emergency update through its privileged Special Fee Contract (SFC), zeroing the native balance of the attacker accounts and replacing their code, so they could no longer send transactions. That did not freeze the stS itself. Because stS supports ERC-2612 permit, the attacker signed an approval for another account it controlled, pulled the tokens with transferFrom and swapped them over several transactions.
Sonic Labs later recovered 5,829,196 S through tracing, on-chain messages to the attacker, exchange freezes and legal coordination, and paid it to affected users through a claims portal.
Frozen attacker wallets:
0xf19fd5c683a958ce9210948858b80d433f6bfae2
0x045371528a01071d6e5c934d42d641fd3cbe941c
How it happened
- The attacker exploited the inherited Balancer V2 Stable Pool precision-loss bug in two Beets V2 pools, draining about $3M worth of
stS. - Sonic Labs updated the SFC to set the attacker accounts' native balance to zero and replace their code with a contract that has no public functions.
- The frozen accounts could not send transactions, but still held
stS. The attacker signed an ERC-2612permitgiving another account it controlled an allowance. - That account called
transferFromto move thestSout and swapped it across multiple transactions.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
