Balancer hack analysis and guidance for the DeFi ecosystem

Summary: On November 3, 2025, attackers exploited a rounding direction error in Balancer v2 to drain more than $100M across nine blockchain networks, and Trail of Bits confirmed Balancer v3 was not affected. Trail of Bits had flagged the same rounding behavior in its October 2021 review of Balancer's Linear Pools as finding TOB-BALANCER-004, marked 'undetermined severity' because exploitability could not be determined at the time, and the Composable Stable Pools later hacked were reviewed in September 2022 with the Stable Math library explicitly out of scope.
What you should know: A rounding error of 1 wei that a fuzzer flags as insignificant became profitable in a low-liquidity pool with specific parameters, turning a finding rated 'undetermined severity' four years earlier into a $100M loss across nine chains.

Read the original at Trail of Bits Blog ↗