Yeliz Akmaca 
The Balancer hack entered a new phase as the attacker began to liquidate stolen tokens shortly after the protocol confirmed the recovery of $4.1 million. Fresh movements across multiple addresses indicate preparation for additional selling, and on-chain analysts continue to track the rapid flow of funds.
Arkham Intelligence reported that the exploiter transferred 6,999 ETH to a newly created wallet. The movement followed an earlier one-ETH test transaction the attacker used to verify routing paths, a method frequently seen in DeFi exploit behavior. These transfers suggest a coordinated attempt to secure exit liquidity before further recovery efforts restrict access.
Recovery Efforts Reveal Hidden Scaling Vulnerability
Balancer stated that the recovered amount was tied to a vulnerability inside its internal scaling logic. The issue originated from a function responsible for adjusting token values during pool calculations. The attacker identified small rounding discrepancies and repeated swap operations to generate precise micro-profits. This approach differed from earlier Balancer incidents and demonstrated how new attack vectors continue to emerge in decentralized finance.
StakeWise also recovered a major portion of the assets drained during the event. The project retrieved 5,041 osETH through a smart contract call, reducing the overall stolen amount from $117 million to $98 million. The improvement helped several platforms restore halted services. Stader Polygon resumed MaticX unstaking after temporarily suspending withdrawals to prevent liquidity access during the critical stage of the investigation.
Major Crypto Security Breaches Continue Through 2025
The Balancer exploit adds to a series of high-impact attacks that shaped the crypto landscape in 2025. Earlier in the year, Cetus Protocol lost $260 million after a coordinated exploit. Investigators traced 12.9 million SUI to an attacker-linked wallet before the funds were moved through USDC and converted into ETH. Bybit also faced a severe security breach involving more than $1.4 billion in digital assets, marked by unusual ETH withdrawals from addresses tied to exchange inflows. Centralized platform BigONE reported a $27 million loss after attackers accessed its hot wallet, draining BTC, ETH, SOL, SHIB and USDT.
These incidents illustrate a broader trend of exploiters combining multi-chain routing, stablecoin swaps and rapid wallet transitions to obscure their tracks. Analysts emphasize that these patterns now form a consistent framework across most high-value attacks.
On-Chain Signals and Market Impact as the Investigation Continues
The attacker’s movements have intensified market attention as observers monitor large-scale transfers and potential liquidation strategies. The ongoing activity increases concerns about short-term liquidity pressure, especially in ecosystems linked to Balancer’s pools. On-chain experts note that rising conversion frequency, new address creation and repeated routing tests often indicate imminent selling phases during post-exploit periods.
The Balancer hack continues to evolve as investigators analyze transaction patterns and track the remaining assets. Market participants remain alert, recognizing that the attacker’s next steps could influence sentiment, trading volume and liquidity in the coming days.
You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.