Balancer Exploit Drains $128 Million Across Six Blockchains, Ethereum Hit Hardest

• Exploit Amount: Over $128 million drained, with Ethereum losing $99 million in key assets like WETH and ETH derivatives.

• The attack affected multiple chains including Berachain, Arbitrum, Base, Sonic, Optimism, and Polygon due to inherited flaws in protocol forks.

• Balancer’s TVL fell nearly 50% from $443 million to $255.82 million, as reported by DeFi Llama, triggering widespread user withdrawals.

Discover the details of the 2025 Balancer exploit that stole $128M across chains. Learn causes, impacts, and recovery steps in this comprehensive analysis. Stay informed on DeFi security risks today.

What is the Balancer Exploit of 2025?

The Balancer exploit refers to a major security breach on November 3, 2025, where attackers exploited a flaw in Balancer’s V2 protocol to withdraw over $128 million in funds from liquidity pools across six blockchains. This incident involved unauthorized access to boosted pools on Ethereum and its forks, leading to immediate network responses like Berachain’s halt. The event underscores the vulnerabilities in DeFi smart contracts despite ongoing audits.

How Did the Vulnerability in Balancer’s Access Controls Lead to the Hack?

The core issue stemmed from a faulty access control mechanism in Balancer V2’s smart contracts, which failed to properly verify permissions for internal withdrawals from boosted pools. According to security firm PeckShield, this allowed attackers to drain assets without authorization, starting on Ethereum and rapidly spreading to interconnected chains. The exploit affected protocol forks, amplifying the damage; Ethereum saw $99 million in losses including WETH, osETH, and wstETH, while Berachain, Arbitrum, Base, Sonic, Optimism, and Polygon reported losses totaling the remainder.

Experts note that such flaws often arise from complex inheritance in forked codebases, where updates on one chain do not fully sync security patches across all deployments. Balancer’s team acknowledged the breach promptly, but the multi-chain nature complicated containment efforts. Data from on-chain analytics shows the attack unfolded in hours, with transactions confirming the unauthorized transfers.

November opens with another major blow to crypto markets as Balancer suffered a devastating $128 million exploit across six blockchains on 3 November.

The attack exploited a critical vulnerability in the protocol’s access control system, draining funds and forcing Berachain to take the unprecedented step of halting its entire network.

Source: X

The hack marks one of 2025’s largest DeFi exploits, coming just as traders hoped for better fortune after October failed to deliver the typical “Uptober” rally many expected.

Six Chains Compromised in Hours

On 3 November 2025, the DeFi protocol Balancer, primarily its V2 vaults and boosted pools, suffered a major exploit.

The exploit was due to a faulty access control vulnerability in smart contract checks, allowing unauthorized internal withdrawals. The attack spread across multiple blockchains within hours.

Ethereum bore the brunt with $99 million stolen, including significant amounts of WETH, osETH, and wstETH. Berachain lost $12.86 million, Arbitrum $6.86 million, BASE $3.9 million, Sonic $3.44 million, Optimism $1.58 million, and Polygon $232,000.

Source: PeckShield

The vulnerability didn’t just affect Balancer’s main deployment.

Protocol forks running on various chains inherited the same security flaw, multiplying the attack surface and enabling hackers to drain funds across the entire ecosystem simultaneously.

Berachain Takes Drastic Action

Berachain validators responded with an emergency measure rarely seen in blockchain networks. The team coordinated a purposeful network halt to perform an emergency hard fork addressing the Balancer-related exploits.

“The Berachain validators have coordinated to purposefully halt the Berachain network as the core team performs an emergency hard fork to address Balancer V2 related exploits on the BEX,” the official announcement stated.

Balancer’s TVL Crashes

Balancer’s Total Value Locked plummeted from approximately $443 million to $255.82 million, nearly a 50% drop in hours. The DeFi Llama chart shows a sharp decline as users rushed to withdraw funds and avoid further losses.

Source: DefiLlama

The exodus reflects a loss of confidence in the protocol’s security. Even users on unaffected pools fled, unsure whether additional vulnerabilities might exist.

2025’s Hack Landscape

The Balancer exploit ranks as the third-largest crypto hack of 2025. North Korea’s Lazarus Group reportedly stole $1.5 billion from Bybit in February, marking the largest crypto theft ever.

Hackers drained $223 million from Cetus Protocol in May. The year has seen over $2.17 billion stolen in the first half alone, with Iran’s Nobitex losing $90 million in June to Israeli-linked Predatory Sparrow, and India’s CoinDCX losing $44.2 million in July.

Unlike single-exchange breaches, Balancer’s $128 million loss spread across six blockchains, exposing how one vulnerability in forked protocols can cascade across entire ecosystems.

A Rough Start to November

The timing compounds the damage to market sentiment.

October 2025 failed to deliver the historical “Uptober” gains traders anticipated, leaving many disappointed. The market suffered one of the largest liquidations in history in October, when almost $20 billion was lost.

Now, November opens with one of the year’s largest DeFi hacks, adding pressure to already cautious markets.

The Balancer team confirmed awareness of the exploit and stated that the investigation was ongoing.

Frequently Asked Questions

How much did hackers steal in the Balancer exploit of 2025?

Attackers drained over $128 million across six blockchains, with Ethereum accounting for the largest amount at $99 million in assets like WETH and staked ETH variants. Other chains including Berachain and Arbitrum saw combined losses exceeding $25 million, as detailed in on-chain reports from PeckShield.

What caused the vulnerability in the Balancer protocol?

The issue arose from a faulty access control check in Balancer V2’s smart contracts, enabling unauthorized withdrawals from boosted pools. This flaw, inherited by forks on multiple chains, allowed the rapid multi-chain exploitation, prompting immediate responses like Berachain’s network halt for security upgrades.

Key Takeaways

• Multi-Chain Impact: The Balancer exploit affected six blockchains, totaling $128 million in losses and demonstrating the risks of protocol forks sharing unpatched vulnerabilities.
• Security Response: Berachain’s emergency network halt and hard fork highlight proactive measures, though they underscore the challenges of maintaining DeFi protocol integrity across ecosystems.
• Market Sentiment: Coming after a disappointing October, this hack intensifies caution among investors; monitoring ongoing investigations from Balancer is essential for assessing recovery.

Conclusion

The 2025 Balancer exploit, with its $128 million toll across Ethereum and five other chains due to access control vulnerabilities, serves as a stark reminder of DeFi’s security challenges. As protocols like Balancer V2 continue investigations and implement fixes, the broader crypto community must prioritize robust audits and cross-chain coordination. Investors should remain vigilant, focusing on verified updates to navigate this evolving landscape effectively.