Balancer V2 Exploit November 2025: Rounding Bug and Lessons

On November 3, 2025, Balancer disclosed that its V2 vault had been exploited. Post-mortems place the incident at about 7:46 AM UTC and say it affected Composable Stable Pools, a pool type that holds several related tokens, such as wrapped or yield-bearing versions of the same asset, in one pool.

The attacker did not steal private keys or trick users into signing a malicious message. The exploit used a flaw in the protocol's own on-chain math. An attacker who understands that math can submit a transaction that the code processes in a way its designers did not intend.

This matters for readers because it separates two kinds of risk. A wallet compromise happens to one user. A logic flaw in shared protocol code can affect every position that depends on the same pools at once. A clean audit history reduces the chance of a bug but does not remove it, which is why post-mortems stress layered defences such as monitoring, rate limits and fast response procedures.

If you want the short version: a rounding error in deployed stable pool code was used, in one batched sequence of operations, to pull value out of multiple pools. The rest of this guide explains each part of that sentence and what it means for users.

Stable pools are built to keep tokens that should trade close to parity near each other in price. To do this, the contract scales token balances to a common precision, runs its invariant math, and then scales the results back to native token amounts.

Every step of that process involves integer arithmetic. Integer math cannot represent every fraction exactly, so it rounds. Normally the rounding is tiny and harmless. The problem appears when rounding in one direction can be pushed repeatedly, or when the attacker can shape the inputs so the rounding favours them on each step.

The post-mortems describe a rounding issue in the array scaling logic, which is the part of the code that adjusts balances before the invariant is calculated. Trail of Bits and other analysts note that arithmetic bugs of this kind are easy to miss because each individual operation looks correct. The error only shows up when a specific sequence of values is fed through the whole path.

For non-developers, the lesson is that a single rounding choice can be a security decision. Code that works for normal trades can still be exploitable at the edges, especially in pools that handle unusual token ratios or tokens with different decimal places.

A flash loan lets a borrower take a large amount of assets without collateral, as long as the loan is repaid within the same transaction. If the repayment fails, the whole transaction reverts. Flash loans are a normal DeFi tool for arbitrage and refinancing.

In this incident, flash loans supplied the capital needed to make the rounding error worth exploiting at scale. An attacker who can only use their own funds may be limited to small gains. With borrowed capital, even a tiny per-trade advantage can be multiplied across a large position.

Halborn and Immunefi both describe the attack as using batched swap operations, which let the attacker run several steps in one transaction. Batching is efficient for honest users, but it also means the attacker can combine operations that would be harder to chain separately.

The broader point for DeFi designers is that a flaw that looks small on its own can become serious when combined with cheap, large, temporary capital. Protocols therefore test not only single functions but also how functions behave when chained and when fed extreme inputs. Users can take a similar view: a protocol's risk depends on the tools its contracts interact with, not only on its own code.

Balancer V2 used a vault design in which many pools share a single vault contract for token custody and accounting. This design has advantages, including lower gas costs and simpler management of token balances across pools.

Halborn points to the interconnected nature of Balancer V2 pools as part of why the attack spread across multiple pools. When pools share infrastructure, a flaw in shared logic can affect more than the pool where the attacker started.

The Certora analysis frames the incident as attackers manipulating internal vault logic to drain liquidity across several pools. OpenZeppelin's technical write-up similarly separates the attack itself from the wider lessons about how protocols should be reviewed and monitored.

For users, this is a useful checklist item. Before depositing, check whether a protocol's pools share one core contract, whether the team publishes incident history, and whether they describe how they respond to a bug. Shared architecture can make a protocol more efficient and also more sensitive to a single error, so it is worth understanding the design, not just the advertised yield.

Loss figures in the Balancer case differ across sources. Checkpoint's headline refers to a $128 million drain. Immunefi and Bates White describe losses over $100 million, and some write-ups use approximate values.

These differences are normal in DeFi incidents. Analysts may count gross outflows or net losses after recoveries. They may price tokens at the time of the attack or at a later date, and token prices can move sharply in hours. Some assets may be counted once even if they moved through several contracts during the attack.

Because figures change, this guide does not treat any single number as final. The reliable approach is to read the official Balancer post-mortem first, then compare the technical analyses from Checkpoint, Halborn, Trail of Bits, Certora and OpenZeppelin. If the numbers disagree, look for the method each source used and the date it measured.

When you cite a loss figure yourself, say which source gave it, when it was published and whether it is a gross or net estimate. That habit prevents repeating a number that later analysis has changed.

The exploit affected users who had funds in the affected Balancer V2 pools at the time. Liquidity providers in those pools bore the loss in proportion to their share, so the impact was not limited to traders or to one token.

The results supplied for this guide describe the incident and its technical causes but do not confirm the final status of every recovery effort, token or compensation plan. Because recovery status can change, readers should check Balancer's official channels for the latest update rather than relying on a third-party summary.

If you held a position in a Balancer V2 pool, the practical steps are these:

• Check the official Balancer announcements for the current status of affected pools.
• Confirm which contract addresses you are interacting with, using the protocol's own documentation.
• Be cautious of anyone offering to recover funds in exchange for a signature, a seed phrase or an upfront fee. Recovery scams often follow large incidents.

Never share your seed phrase or grant broad token approvals to a site that contacts you about the exploit. Legitimate teams do not need your seed phrase.

Several of the post-mortems stress that the core failure was an arithmetic error that passed review and testing. The lesson is not that stable pools are inherently unsafe, but that numeric edge cases need explicit, adversarial testing, including extreme balances, unusual decimals and batched sequences.

Trail of Bits argues that arithmetic issues of this type deserve special attention as protocols age, because the threat environment changes over time. Code that was reasonable when first written may face attackers with better tools and more capital.

OpenZeppelin's analysis highlights the value of learning from incidents at the level of process, not only code. Teams can improve how they test invariants, how they monitor unusual transactions and how quickly they can pause affected functions.

For the wider DeFi community, the incident reinforces a few principles: formal and manual review both matter, bug bounty programmes help surface problems early, and monitoring tools that flag abnormal swap patterns can shorten the time between an attack starting and a response. Users benefit when they choose protocols that show these practices in public.

You do not need to understand Solidity to reduce your exposure to incidents like this. The following habits apply to any DeFi protocol:

• Use a dedicated wallet for DeFi activity, separate from the wallet that holds your main savings.
• Revoke token approvals you no longer need, using a reputable approval-management tool and reading each request before you sign.
• Avoid depositing more than you can afford to lose in newer or lightly reviewed pools, even when yields look high.
• Check whether a protocol has public audits, a bug bounty and a documented incident history.
• Follow official channels rather than unsolicited direct messages.

Spreading funds across several reputable protocols can reduce the impact of any single failure, but it also adds complexity. Track each position so you know where your assets sit.

If you see a sudden, unexplained withdrawal request, a site asking you to sign an unfamiliar transaction, or someone claiming to be support, stop and verify through the official website. Scammers often use the publicity of a real exploit to target people who are worried about their funds.

Because incident details and recovery status change, use the sources below to confirm the current picture:

• Balancer's official announcements and post-mortem for the authoritative account of the incident and any affected pools.
• Independent technical analyses from Checkpoint, Halborn, Trail of Bits, Certora, OpenZeppelin, Bates White and Immunefi, all published in November 2025 or later.
• Blockchain explorers, where you can inspect the relevant transactions and contract addresses yourself.
• Reputable security news outlets and incident trackers that record dates, methods and loss estimates.

When a source gives a loss figure, check whether it is gross or net, what prices it used and when it was published. When a source gives a recovery update, check whether the update comes from the protocol itself.

This guide describes the November 2025 Balancer V2 exploit as reported by the sources available. It does not provide live prices or current balances, because those change constantly. For up-to-date values, use a reputable price tracker and your own wallet or the protocol interface.