Refund Plan for Recovered Assets

The protocol will return the $8 million in recovered tokens, secured by whitehat teams and Balancer internal security, to affected users in the same token types. StakeWise separately handles $19.7 million in osETH and osGNO positions with an independent recovery timeline.

Whitehat actors, who helped secure funds ahead of the hacker, will receive 10% of the recovered assets as rewards, paid in the same token types. Some chose to waive their rewards, highlighting ethical hacking compliance under Balancer’s Safe Harbor Agreement.

Affected users will connect their wallets, verify balances via snapshot, and accept a short legal agreement. Approved claims are paid instantly. The claim window is expected to be open for 90–180 days, after which unclaimed funds may be redirected by DAO vote.

Market Impact and Behavioral Analysis

Following this, the attacker recently moved 6,999 ETH to a new wallet, triggering increased attention and scrutiny on on-chain analytics platforms. After the exploit, Balancer’s TVL dropped from $775 million to $258 million, and the BAL token lost roughly 30% of its value. Meanwhile, the announcement of the refund plan led to a 2% recovery in BAL price over the past 24 hours.

The root cause of the attack was minor rounding errors in some v2 pool balance calculations. This flaw created extremely unbalanced pools, enabling manipulation that drained millions of dollars.

DeFi Security Test

This refund initiative emphasizes transparency and strengthens investor confidence. The DAO expects the claim portal to go live in late December or early January, while StakeWise recovery follows its own schedule. The case underscores the importance of secure DeFi protocols for future investor trust.

You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.

The post Balancer Announces $8M Refund Plan After $128M Hack appeared first on Coin Engineer.

Details of the Attack and Preparation

Blockchain analyses show the attacker funded their account stealthily with small 0.1 ETH transfers through Tornado Cash to avoid detection. Coinbase executive Conor Grogan said the attacker stored at least 100 ETH in Tornado Cash smart contracts and that those funds may link to earlier hacks. Grogan stated, “Hacker seems experienced: seeded the account with 100 ETH and operated with 0.1 ETH Tornado Cash transfers. No opsec leaks.” This behavior clearly points to a professional actor who prepared ahead of time. Balancer announced it would offer a 20% white‑hat bounty if the stolen funds were returned in full (minus the reward).

What Makes the Balancer Hack Unique

Deddy Lavid, co‑founder and CEO of blockchain security firm Cyvers, called the Balancer exploit one of the most sophisticated attacks of 2025. The attackers bypassed access control layers to manipulate asset balances directly. This represents a critical failure in operational governance rather than a flaw in core protocol logic.

Lavid also warned that static code audits are no longer enough. He urged platforms to implement continuous, real‑time monitoring to detect suspicious flows before funds are drained.

, co‑founder and CEO of blockchain security firm Cyvers, called the Balancer exploit one of the most sophisticated attacks of 2025. The attackers bypassed access control layers to manipulate asset balances directly. This represents a critical failure in operational governance rather than a flaw in core protocol logic.

Lavid also warned that static code audits are no longer enough. He urged platforms to implement continuous, real‑time monitoring to detect suspicious flows before funds are drained.

Lazarus Group and Long‑Term Preparation Strategies

Similarly, North Korean group Lazarus reportedly paused illicit activity for months before the Bybit hack. Chainalysis data showed a sharp decline in cybercriminal activity after July 1, 2024, which experts interpreted as regrouping to identify new targets and probe infrastructure.

In the Bybit incident, attackers laundered the $1.4 billion through THORChain within 10 days. That operation demonstrates how months‑long stealth and preparation can precede large, professionally executed exploits—parallels that highlight the seriousness of the Balancer incident.

Recommendations for Balancer Users

Store crypto assets only in trusted wallets and avoid moving large sums in single transactions. Be aware that using Tornado Cash and similar mixers can draw attention from professional attackers and investigators, and consider employing multi‑layer security practices to reduce exposure to sophisticated on‑chain exploits.

You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.

The post Was the Balancer DEX Hack Prepared Months in Advance? appeared first on Coin Engineer.

On-Chain Data Strengthens Hack Suspicions

Blockchain security monitoring tools have reported that abnormal amounts of funds were withdrawn from Balancer’s liquidity pools within a short period of time.
Initial findings suggest that attackers may have exploited a vulnerability in the protocol’s smart contracts, leading to the unauthorized fund movements.

According to data shared by on-chain analytics platform PeckShield, hundreds of thousands of dollars worth of digital assets were transferred to multiple wallets. While the scale of the attack and the exact amount of losses have not yet been confirmed, community managers acknowledged the incident and stated that an investigation is ongoing.

BAL Token Price Reacts Sharply

Following the news, Balancer’s native token (BAL) experienced a sharp decline within hours. According to CoinGecko data, the BAL price dropped by nearly 7%, falling to around $0.90. As uncertainty over fund security persisted, a large number of investors shifted to sell positions.

Analysts suggest that while the incident could temporarily undermine confidence in the Balancer ecosystem, the price may recover if the team responds quickly with a strong technical fix and transparent communication.

What Is Balancer?

Founded in 2018, Balancer is one of the largest Ethereum-based automated market maker (AMM) protocols. It allows users to create custom liquidity pools, swap tokens, and earn trading fees from their deposits.

While Balancer has faced a few security vulnerabilities in the past, the team strengthened its audit and risk control processes following a smaller-scale exploit in 2023. However, this latest incident once again highlights that smart contract security remains a weak link within the DeFi industry.

DeFi Security Back in the Spotlight

The recent attack on Balancer serves as a reminder of how vulnerable decentralized finance protocols still are to cyber threats. Experts suggest that, depending on the scale of the breach, DeFi projects may adopt stricter security audits and standards in the coming months.

The Balancer team is currently working with blockchain security firms to determine the full scope of the attack and assess the status of user funds, as the community awaits further updates on the investigation.

You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.

The post DeFi Protocol Balancer Has Been Hacked! appeared first on Coin Engineer.

Balancer depositors’ swift exodus: a decline of nearly $100 million as the withdrawal frenzy hits “There’s a rapid exodus underway,” revealed Xeonus, an anonymous contributor. As a result of this withdrawal frenzy, the protocol’s total value locked (TVL) experienced a staggering decline of nearly $100 million on Tuesday.

You might like: What is Barcelona Fan Token ($BAR)?

Balancer’s Critical Bug Sparks Urgent Response: User-Initiated Withdrawals

Balancer, a decentralized trading platform known for its unique approach to user-contributed liquidity pools, recently discovered a critical bug in its high-interest-paying boosted pools. Upon discovering this critical vulnerability, the Balancer community, under the governance of BAL token holders, swiftly sprang into action, implementing a comprehensive protocol-wide lockdown.

The Balancer crisis response team promptly took action, suspending numerous pools to prevent any potential asset drainage. Yet, amid these efforts, certain pools stubbornly clung to their vulnerability, resisting any attempt at a pause, and thereby, heightening the risk substantially. In response to this situation, Xeonus, a representative from the project, emphasized the importance of securing these at-risk pools through user-initiated withdrawals.

Approximately $10 million is still potentially vulnerable in Balancer, as 1.4% of its total value is at risk.

While the precise bug details remain undisclosed to the public, the project team intends to release a post-mortem analysis once the situation stabilizes. They have already taken emergency measures to secure at least 80% of the affected assets.

Investors in BAL Express concerns amid controlled turmoil the token’s current trading price stands at $3.44, down from its earlier position of $3.55 before the announcement. “We’re holding steady,” Xeonus assures. “All our partners are fully briefed, and no funds have been compromised at this point.”

You can share your opinions in the comments about the topic. Also, follow us on Telegram, Twitter, and YouTube for more content like this.

The post Balancer Depositors Withdraw $100M Amid Vulnerability Alert! appeared first on Coin Engineer.