Balancer Exploit Drains $128 Million as Berachain Freezes Network in Emergency Response
Balancer hacked for $128M as Berachain halts its blockchain to recover losses, sparking debate over DeFi security and decentralization.
The decentralized finance (DeFi) protocol Balancer has suffered one of the largest exploits of 2025, with roughly $128 million drained from liquidity pools across multiple Ethereum-compatible blockchains. The breach, which exploited a flaw in Balancer’s V2 Composable Stable Pools, triggered a chain reaction that forced Berachain—a newer Layer-1 blockchain using Balancer’s codebase—to halt its network and prepare for an emergency hard fork.
According to on-chain analytics firms Nansen, Cyvers, and PeckShield, the exploit originated from a small precision and rounding error in Balancer V2’s pricing algorithm. The attacker manipulated this vulnerability by executing multiple swaps within a single transaction, pushing the pool’s internal balance toward a rounding discrepancy. This caused the Balancer Pool Token (BPT), which represents shares in liquidity pools, to become undervalued. The exploiter then minted these tokens at a deflated rate and immediately redeemed them for the underlying assets—mostly ETH—before converting them into other tokens across decentralized exchanges.
Initial estimates from Nansen placed the total loss at around $100 million, though later analyses by Cyvers and PeckShield raised the figure to roughly $128 million as the attack spread across chains, including Ethereum, Arbitrum, and Base. The attacker’s wallets were seen funneling funds through multiple addresses to obfuscate transactions, with portions of the stolen assets likely converted through DeFi protocols and mixers.
Balancer confirmed the exploit early Monday, noting that the issue is limited to its V2 Composable Stable Pools and does not affect the newer V3 framework. “Our team is working with leading security researchers to understand the issue and will share a full postmortem as soon as possible,” Balancer said on X (formerly Twitter). The project’s native BAL token fell more than 11% following the news, dropping to a market capitalization of approximately $56 million.
One of the most severe consequences unfolded on Berachain, where the attack caused an estimated $12.86 million in losses. Because Berachain’s decentralized exchange (BEX) relies on the same Balancer V2 architecture, validators took the extraordinary step of halting the network. The Berachain Foundation announced plans for a hard fork to roll back the chain to its pre-exploit state—a decision that has ignited debate among crypto purists.
Critics argue that reversing a blockchain contradicts the principle of immutability, a cornerstone of decentralized technology. Historical parallels have already been drawn to Ethereum’s 2016 DAO hack, when a hard fork to recover $50 million in stolen ETH led to the birth of Ethereum Classic. Supporters of Berachain’s rollback counter that, given the exploit’s technical nature and its impact on non-native assets, intervention is necessary to preserve the network’s integrity.
As investigations continue, security experts warn that similar vulnerabilities could exist in protocols built upon Balancer’s V2 codebase. The event underscores the fragility of composable DeFi ecosystems, where a single line of code replicated across chains can lead to cascading losses. For now, the Balancer community—and DeFi at large—faces renewed questions about security, decentralization, and the price of resilience in an increasingly interconnected financial web.
