DeFi protocol Balancer suffered a major breach on Monday, affecting Balancer V2 Composable Stable Pools. Total losses across multiple chains reached over $128 million, per PeckShieldAlert.
However, a recent update from on-chain analyst EmberCN said that liquid staking, StakeWise, has managed to recover 5,041 osETH ($19.3 million) from the Balancer hacker via a contract call.
“So, the assets stolen by the hacker from Balancer have dropped from $117 million to $98 million,” EmberCN said, adding that over half of the stolen assets have been converted to ETH.
Nansen analysts first flagged suspicious transfers of WETH, osETH and wstETH to a fresh wallet. The attack ran for a few hours.
According to Cyvers Alerts, the hacker began laundering funds via Tornado Cash. Later, the attacker started swapping the stolen funds for Ethereum, Lookonchain stated.
A DeFi researcher on X, outlined the sophisticated sequence of smart-contract manipulations. According to the deep analysis, improper authorization and callback handling allowed the attacker to bypass safeguards.
“This enabled unauthorized swaps or balance manipulations across interconnected pools, draining assets in rapid succession (within minutes).”
The hacker used a key Ethereum mainnet to initiate a series of transactions, followed by the consolidation of funds onto mixers for laundering.
Hours later, the platform acknowledged the breach impacting its v2 pools. “Our engineering and security teams are investigating with high priority,” Balancer team wrote on X.
“All other Balancer pools are unaffected. This issue is isolated to V2 Composable Stable Pools and does not impact Balancer V3 or other Balancer pools.”‘
Further, one whale has responded to the incident after being dormant for 3 years, withdrawing $6.5m from the platform.
Balancer’s total value locked (TVL) has halved from $442M on 2 November to $214.52M in less than a day, DeFiLlama data revealed.
Similar to the incident, in September, DeFi yield platform Nemo Protocol suffered a cyberattack that resulted in $2.4 million in losses as its TVL crashed 75% from $6.3M.
