The Ethereum-based decentralized finance (DeFi) protocol, Balancer, has fallen prey to an exploit resulting in losses of almost $900,000.
This incident occurred shortly after the protocol’s public disclosure of a vulnerability affecting its boosted pools.
The exploit and subsequent loss were confirmed by the protocol itself on social media platform X (formerly Twitter) on August 27th.
Leading blockchain security expert Meier Dolev traced an Ethereum address believed to be linked to the attacker. This address received significant transfers of Dai stablecoin, amounting to $636,812 and $257,527, respectively, accumulating over $893,978 in the attacker’s possession.
The protocol’s team promptly addressed the situation by acknowledging the exploit linked to the disclosed vulnerability.
While they had implemented measures to reduce risks, they clarified that stopping the affected pools was not feasible. To prevent further breaches, users were advised to withdraw from the impacted liquidity pools.
On August 22nd, Balancer disclosed a critical vulnerability, leading to an urgent call for users to withdraw funds from liquidity providers and the temporary suspension of pools.
This vulnerability posed a threat to assets across platforms, including Ethereum, Polygon (MATIC), Arbitrum (ARB), Optimism (OP), Avalanche (AVAX), Gnosis (GNO), Fantom (FTM), and zkEVM.
Initially, the risk assessment indicated that only 1.4% of total assets were exposed, equivalent to over $5 million.
However, as of August 24th, substantial risk remained, with vulnerable funds totaling at least $2.8 million, accounting for 0.42% of the total locked value.
Balancer issued user warnings on X, explaining the status of funds in various pools. Mitigated pools labeled as ‘mitigated’ were considered safe. Users were strongly advised to consider migrating to secure pools or initiating fund withdrawals. Pools labeled ‘at risk’ required LPs to exit promptly.
Balancer’s journey was closely intertwined with its deployment on the Optimism network in the previous year. This deployment aimed to enhance user functionality, reduce transaction fees, and increase accessibility for participants.
