Balancer has released a Vulnerability Disclosure Report: Bulk Exchange Trade Rounding Logic Error Exploited

On November 6th, according to official information, Balancer has issued a preliminary report on the exploit incident. The report shows that the Composable Stable Pool of Balancer V2 was attacked on November 4th across multiple chains (including Ethereum, BSC, Avalanche, Polygon, Arbitrum, etc.). The exploit stemmed from a rounding error in the EXACT_OUT transaction logic during batchSwap, enabling the attacker to manipulate the pool balances and withdraw assets. This incident only had an impact on Balancer V2's Composable Stable Pool, while Balancer V3 and other pool types remained unaffected. The Balancer team quickly cooperated with security partners and white-hat teams to take actions. Through measures such as automatic pause via Hypernative, asset freezing, and white-hat interventions under the SEAL framework, they effectively contained the attack and recovered some assets. StakeWise has retrieved approximately 73.5% of the stolen osETH, and teams like BitFinding and Base MEV bot have also assisted in the recovery of some funds. Currently, Balancer is collaborating with security partners such as SEAL and zeroShadow to carry out cross-chain tracking and fund recovery. The final assessment of losses and recovery data will be disclosed in a comprehensive technical retrospective report. Users are advised to only trust information confirmed through official Balancer channels as the operations of V3 and non-stable pools remain secure.