A single rounding error cost Balancer $128 million. The protocol was years old and heavily audited, and the company that built it didn't survive.

Balancer's own post-mortem points at one place: an internal bug in the rounding logic of the protocol's "upscale" function. It let attackers manipulate vault calls during pool initialization and siphon value the pool should have kept. A year ago today, on November 3, 2025, they used it to drain more than $116 million from Balancer's V2 Stable Pools and Composable Stable Pools. They siphoned WETH, wstETH, osETH, frxETH, rsETH and rETH across Ethereum, Base, Polygon, Arbitrum, Optimism, Berachain and Sonic. By the time the bleeding stopped, PeckShield put the total closer to $128.6 million, making it one of 2025's largest DeFi exploits.

That bug is also why Balancer Labs, the company that built the protocol, no longer exists. Co-founder Fernando Martinelli told the Balancer governance forum on March 23, 2026, that the corporate entity would wind down after what he called six months of legal risk, reputational damage and unsustainable economics. "The company had become a legal liability operating with no revenue," Martinelli wrote, according to a report from Decrypt. The protocol itself survives. It is now run entirely by the Balancer DAO, the Balancer Foundation and a leaner group of service providers. The company that spent years building it doesn't.

Frankly, anyone who treats an audit as a guarantee should be rattled by what came next. Balancer's code had been through eleven audits over its history, according to reporting from Pulse. The Composable Stable Pools had been live and trusted for years before the exploit. The flaw sat in a single rounding function that was supposed to round in the protocol's favour and instead rounded down regardless of context. OpenZeppelin's post-incident writeup flagged that design choice as the actual root cause. No audit caught it. The bug wasn't a missing check: it was math that worked fine almost all the time and failed catastrophically once someone figured out exactly how to abuse it.

Ethereum took the worst of it. It lost roughly $99 million of the total. Berachain, Arbitrum, Base, Sonic, Optimism and Polygon split the rest, with losses ranging from under $250,000 on Polygon to nearly $13 million on Berachain. Six white-hat actors recovered about $3.9 million of the stolen funds across multiple chains. They were led by a researcher labelled "Anon #1", who clawed back $2.68 million on Polygon alone, and security firm Bitfinding, which recovered just under $964,000 on Ethereum mainnet. Separately, the liquid-staking platform StakeWise negotiated its own recovery. It got back roughly $19 million in osETH and $1.7 million in osGNO, about 73.5% of what it lost, directly from the exploiter.

Conduit says Tether's T3 Financial Crime Unit froze its treasury wallet on its own initiative after Brazilian police confirmed they never flagged it, forcing layoffs while Tether kept earning yield on the reserves. - Tether freezes Conduit's $2.76 million in USDT - Stablecoin payment firm sues Tether over frozen funds

Add it up and Balancer's DAO ended up with about $8 million in rescued assets to redistribute, a fraction of the total loss. The reimbursement plan it eventually adopted is deliberately narrow, according to Decrypt. Only liquidity providers in the specific affected pools get paid back, based on their holdings at a snapshot block taken just before the first exploit transaction. They have 180 days to claim before unclaimed funds go dormant. Balancer's governance also voted through BIP-908, a 10% bounty capped at $1 million per recovery, to reward anyone who helps return more.

A legal problem Balancer couldn't code its way out of

The Rosen Law Firm announced in early December 2025 that it was investigating securities claims on behalf of BAL token holders, alleging Balancer may have put out materially misleading information to investors. That's not a technical dispute anyone can patch with an audit. It's the kind of liability that sits on a company's balance sheet indefinitely. It is exactly what Martinelli pointed to when he said the entity had become more legal risk than going concern.

The protocol's numbers tell the rest of the story without needing a lawyer to explain it. Balancer's total value locked had already fallen from a $3.3 billion peak in November 2021 to around $800 million by October 2025. Then the hack knocked off another several hundred million, leaving it near $158 million. The BAL token closed near $0.98 the day before the exploit. It dropped more than 10% within hours and has since traded near all-time lows around $0.15. Martinelli's restructuring plan calls for cutting BAL emissions to zero. It would also retire the veBAL vote-locking model, which he said had been captured by "bribe" dynamics unrelated to the people actually building the protocol. And all protocol fees would go to the DAO treasury instead of the 17.5% cut Balancer Labs used to keep.

What's left is a protocol still running and still holding real liquidity. But it has lost the company that invented it, the token economics that funded it, and a chunk of the trust that took years to build. DeFi has survived exploits before. It's rarer to watch the team behind one of its oldest blue-chip names conclude the company itself isn't worth keeping alive.

Also read: Tether posted a $1.5 billion quarterly profit and $19 billion in gold • Ethereum stablecoin transfers hit a record $2.82 trillion in October • Mercado Bitcoin Loses $46 Million to Hackers Days After Binance Heist

This article is posted in Crypto News, check it out for more related stories.

Join the discussion