Balancer, long considered a pillar of stability in Decentralized Finance (DeFi), saw its reputation collapse on November 3, 2025. The protocol, which had weathered bear markets and passed over ten security audits, fell victim to a sophisticated exploit that drained more than $128 million across multiple blockchains. The attack sent shockwaves through the DeFi community, serving as a harsh reminder that even the most trusted platforms can harbor critical vulnerabilities.

A Coordinated Multi-Chain Breach

The attack was first identified by blockchain security firm PeckShield, which reported an active exploit targeting Balancer and several of its forks. The breach was swift and widespread, siphoning funds from liquidity pools on Ethereum, Berachain, Arbitrum, Base, and other networks. Balancer’s Ethereum deployment suffered the most significant damage, losing approximately $100 million, while its Berachain pools were drained of $12.9 million.

As Balancer’s teams scrambled to investigate, the protocol’s Total Value Locked (TVL) plummeted. Data from DeFiLlama showed a staggering 46% drop in a single day, falling from $770 million to $422 million as investors and integrated protocols rushed to withdraw their assets. In the following days, Balancer’s TVL continued to decline, settling near $310 million.

Anatomy of the Exploit

Early analysis from security firm Phalcon revealed that the attacker manipulated Balancer Pool Tokens (BPT), which represent a user’s share in a liquidity pool. By exploiting how the protocol calculated prices during batch swaps, the attacker distorted internal price feeds. This allowed them to withdraw far more assets than they should have before the system could correct itself.

The protocol’s composable vault architecture, once praised for its flexibility, became a liability by magnifying the damage. As manipulated prices spread from one interconnected pool to another, the losses cascaded across the system. Crypto analyst Adi explained that improper authorization and callback handling allowed the attacker to bypass safeguards and drain assets within minutes.

Evidence suggests the operation was highly professional. Coinbase’s Conor Grogan noted that the attacker’s wallet was funded with 100 ETH from Tornado Cash, a crypto mixer often used to obscure the origins of funds from previous exploits. This detail points toward an experienced and well-prepared actor.

More Than a Hack: A Collapse in Confidence

The psychological fallout from the exploit was as severe as the financial loss. Balancer had built a reputation as a conservative and dependable venue for liquidity providers, where its long history implied safety. That illusion was shattered overnight.

Lefteris Karapetsas, founder of Rotki, described the event as a “trust collapse, not just a hack.” He argued that if a protocol live since 2020 and audited extensively could still suffer a near-total loss of its TVL, it serves as a major red flag for the stability of the entire DeFi ecosystem. The incident exposed the core paradox of DeFi: the same composability that drives innovation also multiplies systemic risk. When a central protocol like Balancer fails, the damage spreads instantly.

When Eleven Audits Aren’t Enough

Perhaps the most alarming aspect of the breach was that Balancer had undergone more than ten independent security audits. The failure to detect this vulnerability has forced a painful reckoning within the industry, dispelling the myth of audit infallibility. As web3 developer Suhail Kakar stated, a stamp of approval from an auditor no longer guarantees safety against the deep complexities of decentralized systems.

The exploit reversed a positive trend for DeFi security. October 2025 had been the quietest month of the year for hacks, with only $18 million in losses. The Balancer incident single-handedly made November one of the worst months on record. For institutional investors and regulators, the event reinforces the perception that DeFi markets remain highly experimental. Balancer’s fall is a stark demonstration that in the world of decentralized finance, resilience is never guaranteed.