Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Author
Sujha Sundararajan
Author
Sujha Sundararajan
share
DeFi Balancer protocol suffered a major breach on Monday, affecting Balancer V2 Composable Stable Pools. Total losses in several chains reached more than $ 128 million, for PeckShieldAlert.
However, a recent update from on-chain analyst EmberCN said that liquid staking, StakeWise, was able to recover 5,041 osETH ($19.3 million) from the Balancer hack via a contract call.
“So, the assets stolen by the Balancer hack dropped from $117 million to $98 million,” EmberCN said, adding that more than half of the stolen assets were converted to ETH.
Balancer Hack in Detail
Nansen analysts first flagged suspicious transfers of WETH, osETH and wstETH to a fresh wallet. The attack lasted for a few hours.
According to Cyvers Alertsthe hacker started laundering funds via Tornado Cash. Later, the attacker started exchanging the stolen funds ethereumLookonchain said.
A DeFi researcher at X, outlined the sophisticated sequence of smart contract manipulations. According to the deep analysis, improper authorization and callback management allowed the attacker to bypass the safeguards.
“This allowed unauthorized exchanges or balance manipulations in interconnected pools, draining assets in rapid succession (within minutes).”
The hacker used an Ethereum key mainnet to start a series of transactions, followed by the consolidation of funds on the mixers for the lake.
Hours later, the platform recognized the breach affecting its v2 pools. “Our engineering and security teams are investigating with high priority,” The Balancer team wrote about X.
“All other Balancer pools are not affected. This issue is isolated to V2 Composable Stable Pools and does not impact V3 Balancer or other Balancer pools.”
In addition, a whale responded to the incident after being dormant for 3 years, withdrawing $6.5m from the platform.
DeFi Protocol TVL Slump
Total Locked Balancer (TVL) value halved from $442 million on November 2nd to $214.52 million in less than a day, DeFiLlama data revealed
Similar to the incident, in September, the performance platform DeFi Nemo Protocol suffered a cyber attack which resulted in $2.4 million in losses as its TVL crashed 75% from $6.3M.
