Balancer Exploit in November 2025: What to Do Now

The November 2025 Balancer exploit was reported to involve a precision-loss bug in Balancer v2 composable stable pools. Attackers used carefully constructed batch swaps to drain liquidity across pools. Reports put losses at about $128 million, though some described the amount as more than $100 million.

If you had funds in a Balancer pool around the incident, don’t assume either that your position was affected or that it is safe now. First identify the network and exact pool contract you used. Then check Balancer’s current incident guidance for that pool before attempting a withdrawal or approving another transaction.

The exploit does not, by itself, establish the current status of any contract, recovery or compensation. In 2026, verify the exact pool’s status before depositing, swapping through it or moving funds into a related position. Treat unsolicited messages offering recovery help with suspicion.

The reported flaw involved _upscaleArray, an internal function handling scaled token amounts. In smart contracts, calculations often use fixed-point numbers rather than ordinary decimal fractions. Rounding during scaling can create small discrepancies; a carefully designed sequence of swaps may be able to exploit those discrepancies if the contract’s checks allow it.

In this incident, reports described a precision-loss or rounding issue combined with crafted batchSwap transactions. The attack affected composable stable pools and drew on the interconnectedness of Balancer v2 pools. This is different from a stolen password or a user tricked into signing a phishing transaction: the reported issue was in contract logic.

That distinction matters when deciding what to do. Changing your wallet password or revoking an allowance does not repair a vulnerable pool contract. Conversely, the incident does not prove that your wallet itself was compromised. Check the pool and transaction details separately from your wallet’s security, and don’t sign transactions based only on a message claiming to explain the exploit.

Start by finding the transaction or position you actually used. A familiar pool name is not enough: Balancer has pools on different networks, and contracts can differ by version and address.

Use this checklist:

1. Identify the network and pool address from your wallet history or transaction records.
2. Check whether your funds were deposited in the affected pool type—reported as Balancer v2 composable stable pools—or another product.
3. Match the exact contract address against Balancer’s current incident instructions. Don’t rely on a token symbol or a search result alone.
4. Check whether your position is still represented in your wallet or through a pool token, and whether the contract is currently usable.
5. If you can’t confirm the pool’s status, pause. Don’t deposit more or approve a new contract to test it.

A position in a different pool or version is not automatically affected, but it is not automatically safe either. The exploit reports do not establish the status of every Balancer contract. If you used an aggregator or another protocol that routed through Balancer, inspect the transaction route and the contracts it interacted with.

If you still have liquidity in a potentially affected pool, check Balancer’s current, pool-specific instructions before taking action. A pool may be paused, its state may have changed, or an attempted withdrawal may fail. Repeatedly submitting transactions without understanding the contract can cost gas and may expose you to additional risks.

Use this order:

1. Confirm the pool address and network.
2. Read the current official incident guidance for that exact pool.
3. Check whether withdrawals are supported and whether the instructions name a replacement or migration contract.
4. Confirm every contract address in your wallet before signing. A token name or logo is not proof that an address is genuine.
5. If instructions are unclear, stop and seek help through Balancer’s official support channels—not through direct messages from strangers.

A successful withdrawal is not guaranteed, and the exploit reports do not establish individual recovery amounts or compensation. Network gas still applies to on-chain transactions and varies with network conditions. Never pay an alleged “unlock,” “recovery” or “verification” fee to someone promising to return your funds.

A contract exploit and a compromised wallet are different problems. If you interacted with a suspicious site or signed an unexpected approval, review your wallet’s token allowances for the relevant network. Revoke allowances only through a wallet feature or a trusted tool whose contract and network you have independently verified.

Revoking an allowance can require a separate on-chain transaction and network gas. It does not recover tokens already drained, undo a completed swap or make a vulnerable pool safe. If you see an unfamiliar transaction, record its details and avoid signing anything else until you understand what happened.

Protect your recovery phrase and private keys: Balancer support, a security researcher or a recovery service should not need them. Don’t install software or share your screen at the request of someone claiming they can restore funds. If you believe your wallet key is exposed, use a clean device and a new wallet with a new recovery phrase, and move remaining assets only after checking the destination address and transaction carefully. Consider getting qualified security help before moving substantial funds.

Before using Balancer in 2026, check the exact pool and contract rather than relying on the brand name alone. The November incident involved a specific class of Balancer v2 pools; it does not establish the safety or status of every Balancer product. Nor does the incident alone show whether a particular contract has since been paused, patched or replaced.

Before you deposit or swap:

• Find a current Balancer announcement that addresses the pool and network you plan to use.
• Compare the pool’s contract address with the address in the official interface and your wallet transaction preview.
• Check whether the pool is active and whether Balancer gives specific instructions for it.
• Review token approvals before confirming a transaction; limit approvals where your wallet allows it.
• Consider whether you can tolerate losing the amount you are putting at risk.

Balancer is a decentralized exchange and liquidity protocol, not a bank account. Smart-contract defects, token risks, transaction costs and changing pool conditions can all affect your funds. If you cannot independently verify a contract’s status, wait rather than treating a working interface as proof that the underlying risk is resolved.

After a high-profile exploit, fake recovery offers and lookalike interfaces can target affected users. Be wary of unsolicited messages, ads or replies that promise compensation, claim to be official support, or ask you to connect a wallet to “verify” a claim. Never share your recovery phrase or private key, and never sign a transaction you cannot explain.

Other mistakes to avoid:

• Assuming every Balancer pool was affected—or assuming yours was not—without checking its contract address.
• Treating an old announcement as confirmation of a pool’s current status.
• Depositing a small test amount into a pool whose safety you have not verified. Even a small test transaction can create risk and cost gas.
• Confusing allowance revocation with fixing a contract vulnerability.
• Trusting a pool name, logo or token symbol instead of checking the address and network.
• Paying an upfront fee to someone who claims they can recover stolen assets.

If you have doubts, pause and verify using Balancer’s official channels. Don’t let urgency or promises of fast recovery push you into an irreversible transaction.

The incident is a reminder that a pool’s apparent stability and a familiar protocol name do not guarantee safe contract arithmetic. The reported bug involved a low-level calculation, but the loss extended across connected pools. For users, the practical lesson is to track the exact contracts behind a deposit, not just the app or token label shown in a wallet.

If you provide liquidity, keep a record of the chain, pool address, deposit transaction and pool tokens you receive. That makes it easier to check whether a specific incident applies to you. Before approving a contract, inspect the transaction details and consider whether the allowance is broader or longer-lived than necessary.

For any DeFi position, decide in advance what you will do if a pool is paused or an exploit is announced. Keep recovery phrases offline, use a wallet you control, and avoid putting funds you cannot afford to lose into a single protocol. These precautions cannot prevent a contract bug, but they can help you identify exposure sooner and avoid signing a second harmful transaction while responding.