Balancer v1 pool drained for $234K

A single Balancer v1 liquidity pool was drained of roughly $234,000 after an attacker exploited a known weakness in the pool’s smart-contract logic. On-chain records show the attacker executed a sequence of calls that manipulated token accounting and allowed withdrawals exceeding the pool’s reserves.

The attacker moved the proceeds through several addresses and converted portions into other tokens. Blockchain analysts and tracing teams are following the transfers to identify final destinations and any attempts to move funds into centralized services.

The exploited flaw is the same class of bug used in earlier Balancer v1 incidents. It affects how pools handle certain token interactions and internal accounting, creating conditions where an attacker can trigger unintended withdrawals when specific token behaviors or call sequences occur. Balancer v2 contracts use different mechanics and are not affected by this vulnerability.

Balancer maintainers and external blockchain security firms began analyzing the transactions after the outflow was detected. The affected pool was isolated so other pools could continue operating. Wallet addresses linked to the exploit have been flagged by monitoring services and compliance teams were notified to screen deposits tied to the incident.

Balancer governance and security channels urged liquidity providers to withdraw or migrate assets from remaining v1 pools and to apply available patches. Auditors recommended that pool operators avoid tokens with unusual transfer hooks and review contract configurations against updated guidance.

Security researchers noted the amount lost in this incident is smaller than several past decentralized finance incidents and that the same class of bug has been abused previously on Balancer v1 pools. On-chain tracing and law enforcement teams continue to monitor the addresses involved.