Balancer hack Archives - Coin Engineer

Balancer Hack Update: Attacker Starts Selling Stolen Tokens

Yeliz Akmaca — Fri, 14 Nov 2025 13:30:34 +0000

The Balancer hack entered a new phase as the attacker began to liquidate stolen tokens shortly after the protocol confirmed the recovery of $4.1 million. Fresh movements across multiple addresses indicate preparation for additional selling, and on-chain analysts continue to track the rapid flow of funds.

Arkham Intelligence reported that the exploiter transferred 6,999 ETH to a newly created wallet. The movement followed an earlier one-ETH test transaction the attacker used to verify routing paths, a method frequently seen in DeFi exploit behavior. These transfers suggest a coordinated attempt to secure exit liquidity before further recovery efforts restrict access.

Recovery Efforts Reveal Hidden Scaling Vulnerability

Balancer stated that the recovered amount was tied to a vulnerability inside its internal scaling logic. The issue originated from a function responsible for adjusting token values during pool calculations. The attacker identified small rounding discrepancies and repeated swap operations to generate precise micro-profits. This approach differed from earlier Balancer incidents and demonstrated how new attack vectors continue to emerge in decentralized finance.

StakeWise also recovered a major portion of the assets drained during the event. The project retrieved 5,041 osETH through a smart contract call, reducing the overall stolen amount from $117 million to $98 million. The improvement helped several platforms restore halted services. Stader Polygon resumed MaticX unstaking after temporarily suspending withdrawals to prevent liquidity access during the critical stage of the investigation.

Major Crypto Security Breaches Continue Through 2025

The Balancer exploit adds to a series of high-impact attacks that shaped the crypto landscape in 2025. Earlier in the year, Cetus Protocol lost $260 million after a coordinated exploit. Investigators traced 12.9 million SUI to an attacker-linked wallet before the funds were moved through USDC and converted into ETH. Bybit also faced a severe security breach involving more than $1.4 billion in digital assets, marked by unusual ETH withdrawals from addresses tied to exchange inflows. Centralized platform BigONE reported a $27 million loss after attackers accessed its hot wallet, draining BTC, ETH, SOL, SHIB and USDT.

These incidents illustrate a broader trend of exploiters combining multi-chain routing, stablecoin swaps and rapid wallet transitions to obscure their tracks. Analysts emphasize that these patterns now form a consistent framework across most high-value attacks.

On-Chain Signals and Market Impact as the Investigation Continues

The attacker’s movements have intensified market attention as observers monitor large-scale transfers and potential liquidation strategies. The ongoing activity increases concerns about short-term liquidity pressure, especially in ecosystems linked to Balancer’s pools. On-chain experts note that rising conversion frequency, new address creation and repeated routing tests often indicate imminent selling phases during post-exploit periods.

The Balancer hack continues to evolve as investigators analyze transaction patterns and track the remaining assets. Market participants remain alert, recognizing that the attacker’s next steps could influence sentiment, trading volume and liquidity in the coming days.

You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.

The post Balancer Hack Update: Attacker Starts Selling Stolen Tokens appeared first on Coin Engineer.

Was the Balancer DEX Hack Prepared Months in Advance?

Yeliz Akmaca — Tue, 04 Nov 2025 13:30:53 +0000

An experienced attacker stole $116 million from Balancer DEX on Monday after months of preparation. On-chain data shows the attacker used Tornado Cash and sophisticated methods to move funds without leaving traces, indicating the operation was planned in advance.

Details of the Attack and Preparation

Blockchain analyses show the attacker funded their account stealthily with small 0.1 ETH transfers through Tornado Cash to avoid detection. Coinbase executive Conor Grogan said the attacker stored at least 100 ETH in Tornado Cash smart contracts and that those funds may link to earlier hacks. Grogan stated, “Hacker seems experienced: seeded the account with 100 ETH and operated with 0.1 ETH Tornado Cash transfers. No opsec leaks.” This behavior clearly points to a professional actor who prepared ahead of time. Balancer announced it would offer a 20% white‑hat bounty if the stolen funds were returned in full (minus the reward).

What Makes the Balancer Hack Unique

Deddy Lavid, co‑founder and CEO of blockchain security firm Cyvers, called the Balancer exploit one of the most sophisticated attacks of 2025. The attackers bypassed access control layers to manipulate asset balances directly. This represents a critical failure in operational governance rather than a flaw in core protocol logic.

Lavid also warned that static code audits are no longer enough. He urged platforms to implement continuous, real‑time monitoring to detect suspicious flows before funds are drained.

, co‑founder and CEO of blockchain security firm Cyvers, called the Balancer exploit one of the most sophisticated attacks of 2025. The attackers bypassed access control layers to manipulate asset balances directly. This represents a critical failure in operational governance rather than a flaw in core protocol logic.

Lavid also warned that static code audits are no longer enough. He urged platforms to implement continuous, real‑time monitoring to detect suspicious flows before funds are drained.

Lazarus Group and Long‑Term Preparation Strategies

Similarly, North Korean group Lazarus reportedly paused illicit activity for months before the Bybit hack. Chainalysis data showed a sharp decline in cybercriminal activity after July 1, 2024, which experts interpreted as regrouping to identify new targets and probe infrastructure.

In the Bybit incident, attackers laundered the $1.4 billion through THORChain within 10 days. That operation demonstrates how months‑long stealth and preparation can precede large, professionally executed exploits—parallels that highlight the seriousness of the Balancer incident.

Recommendations for Balancer Users

Store crypto assets only in trusted wallets and avoid moving large sums in single transactions. Be aware that using Tornado Cash and similar mixers can draw attention from professional attackers and investigators, and consider employing multi‑layer security practices to reduce exposure to sophisticated on‑chain exploits.

The post Was the Balancer DEX Hack Prepared Months in Advance? appeared first on Coin Engineer.

Balancer Hack: Stolen Millions Moved Into This Coin!

Yeliz Akmaca — Tue, 04 Nov 2025 07:26:24 +0000

Balancer, one of the leading protocols in the DeFi ecosystem, has faced one of the largest attacks in recent years. In the exploit targeting Balancer’s V2 pools, the total amount drained from the platform exceeded $116.6 million. Some analyses even estimate the losses to be as high as $128 million. This incident has sparked widespread discussions around the question: “What is the Balancer hack?”

Main Components of the Attack

According to Arkham and other on-chain analysts, the stolen assets primarily consisted of two categories:

Liquid Staked Ethereum (LSETH) derivatives, particularly wstETH and osETH,
WETH (Wrapped Ether).

The high liquidity of these assets enabled the attacker to quickly convert them into other forms without attracting immediate attention.

How the Hacker Moved and Laundered the Funds

On-chain tracking revealed a three-stage strategy:

Consolidation of Funds
The stolen wstETH, osETH and WETH were first gathered into several primary collection wallets linked to the attacker.
Asset Swaps via DEXs
The attacker then swapped these LSETH derivatives and WETH into ETH using decentralized exchanges. This move helped consolidate value into a single asset type, making it easier to manage and harder to trace.
Distribution Across New Wallets
The converted ETH was transferred into a large number of newly created wallets. This “distribution network” is a common laundering technique designed to make tracking harder for investigators and blockchain analytics firms.

A Multi-Chain Security Breach

The attack was not limited to the Ethereum network. Balancer pools across Arbitrum, Base, Optimism, and Polygon were also affected. Liquidity providers saw sudden drops in pool balances, and many users rushed to revoke token approvals from Balancer smart contracts.

Balancer’s Response

In response to the exploit, the Balancer team took the following actions:

Paused all affected V2 pools that could be secured via emergency controls,
Advised liquidity providers to revoke token approvals and withdraw funds,
Offered up to 20% white-hat bounty if the stolen funds are returned,
Initiated a comprehensive post-mortem investigation and legal action alongside blockchain forensic experts and law enforcement.

The post Balancer Hack: Stolen Millions Moved Into This Coin! appeared first on Coin Engineer.