Balancer DeFi Protocol Recovers $19.3M Hours After Multi-Million Hack

DeFi protocol Balancer suffered a major breach on Monday, affecting Balancer V2 Composable Stable Pools. Total losses across multiple chains reached over $128 million, per PeckShieldAlert.

However, a recent update from on-chain analyst EmberCN said that liquid staking, StakeWise, has managed to recover 5,041 osETH ($19.3 million) from the Balancer hacker via a contract call.

“So, the assets stolen by the hacker from Balancer have dropped from $117 million to $98 million,” EmberCN said, adding that over half of the stolen assets have been converted to ETH.

今天凌晨 @stakewise_io 通过合约调用从 Balancer 黑客手上把 5,041 枚 osETH ($1930 万) 给搞回去了。
所以黑客从 Balancer 盗取的资产从 $1.17 亿下降到 $9800 万。

黑客陆续把 LST 换成 ETH，目前的话已经把超过半数被盗资产换回成 ETH。

黑客地址集：https://t.co/wPWVhdtTEz

本文由… https://t.co/b5c8aBkf6J pic.twitter.com/DJjVjUy8N9

— 余烬 (@EmberCN) November 4, 2025

Balancer Hack in Detail

Nansen analysts first flagged suspicious transfers of WETH, osETH and wstETH to a fresh wallet. The attack ran for a few hours.

.@Balancer potentially exploited.

$70.9M moved to a fresh wallet. Tokens moved:
– 6.85K $OSETH
– 6.59K $WETH
– 4.26K $wSTETH pic.twitter.com/kk1hnjmcIW

— Nansen 🧭 (@nansen_ai) November 3, 2025

According to Cyvers Alerts, the hacker began laundering funds via Tornado Cash. Later, the attacker started swapping the stolen funds for Ethereum, Lookonchain stated.

A DeFi researcher on X, outlined the sophisticated sequence of smart-contract manipulations. According to the deep analysis, improper authorization and callback handling allowed the attacker to bypass safeguards.

“This enabled unauthorized swaps or balance manipulations across interconnected pools, draining assets in rapid succession (within minutes).”

Here's everything you need to know about the Balancer Hack:

1. The attack targeted Balancer's V2 vaults and liquidity pools, exploiting a vulnerability in smart contract interactions. Preliminary analysis from on-chain investigators points to a maliciously deployed contract that… pic.twitter.com/udAM4hB0OD

— Adi (@AdiFlips) November 3, 2025

The hacker used a key Ethereum mainnet to initiate a series of transactions, followed by the consolidation of funds onto mixers for laundering.

Hours later, the platform acknowledged the breach impacting its v2 pools. “Our engineering and security teams are investigating with high priority,” Balancer team wrote on X.

“All other Balancer pools are unaffected. This issue is isolated to V2 Composable Stable Pools and does not impact Balancer V3 or other Balancer pools.”’

Further, one whale has responded to the incident after being dormant for 3 years, withdrawing $6.5m from the platform.

DeFi Protocol TVL Slump

Balancer’s total value locked (TVL) has halved from $442M on 2 November to $214.52M in less than a day, DeFiLlama data revealed.

Similar to the incident, in September, DeFi yield platform Nemo Protocol suffered a cyberattack that resulted in $2.4 million in losses as its TVL crashed 75% from $6.3M.

👹 Nemo Protocol loses $2.4M to hackers on Sui blockchain as TVL crashes 75% from $6.3M, marking the third major DeFi hack this month alone.#Sui #Nemohttps://t.co/ZrVfJk2cZr

— Cryptonews.com (@cryptonews) September 8, 2025