Balancer DeFi Protocol Exploited for $100M+ via Rounding Error in V2 Pools
The Balancer DeFi protocol suffered a $100-120 million exploit on November 3, 2025, targeting V2 Composable Stable Pools via rounding errors in batch swap calculations. Researchers identified AI-generated code traces in the exploit, and the vulnerability echoed a similar bug from 2023 that had resurfaced in more complex form.
What happened
Balancer DeFi protocol suffered an exploit on November 3, 2025, affecting V2 Composable Stable Pools with estimated losses between $100 million and $120 million.
Analysts traced the root cause to rounding and batch swap calculation errors in the Balancer Vault. The vulnerability traces back to a similar bug first identified in 2023 that surfaced in more complex form.
Researchers found that parts of the exploit code contained AI-generated traces, suggesting possible use of large language models in exploit development.
Reported impact
The attack resulted in estimated losses between $100 million and $120 million for users of the protocol.
The incident cast doubt on the trustworthiness of DeFi protocols despite Balancer having been active since 2020 and receiving audits from firms including OpenZeppelin and Trail of Bits.
Index analysis
Balancer v2 had been thought more trustworthy than the newer v3 implementation due to its longer existence, yet the exploit occurred on the supposedly more vetted v2.
Other projects based on forks of Balancer's smart contracts were also affected by the same vulnerability.
Governance controls
Balancer had passed several security audits, though the affected vault had been audited only once.
Balancer's engineering and security teams began investigating immediately and stated they would work with leading security researchers to understand what happened and provide a full post-mortem report.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.