Balancer Audits Under Scrutiny After $100M Exploit
Eleven audits fail to stop V2 pool exploit as project dangles 20% bounty for the return of funds
Balancer is under intense scrutiny after an exploit siphoned more than $100 million in crypto from its decentralized exchange and automated market maker. The team told users the breach was isolated to V2 Composable Stable Pools and did not affect Balancer V3 or other pools. The incident has reignited the debate over what security audits really guarantee in DeFi.
Balancer said its contracts had undergone extensive reviews and long running bug bounties. Despite that, the attacker moved over $116 million in staked Ether assets to a fresh wallet, including StakeWise Staked ETH, Wrapped Ether, and Lido wstETH. Early analysis pointed to a smart contract issue with a faulty access check that may have allowed a malicious withdrawal command, though a final root cause has not been confirmed.
Community voices questioned the value of audit badges. Developers noted Balancer had more than ten audits, including multiple passes on its vault, yet the attacker still succeeded. Public records list eleven V2 audits by OpenZeppelin, Trail of Bits, Certora, and ABDK, with the most recent stable pool review reported in September 2022. Some firms declined public comment pending a full postmortem and protections for Balancer forks.
In an on chain message to the exploiter, Balancer offered a white hat bounty of up to 20 percent for the full return of funds within 48 hours. The team said it engaged independent blockchain forensics specialists and is working with law enforcement and regulatory partners should cooperation fail.
As of press time, Balancer had not released a detailed incident report or updates on the bounty outcome. Users and protocols integrated with the affected pools await clarity on remediation steps, recovery prospects, and whether V2 liquidity will be restored or migrated.
