The team behind the Balancer protocol has released its first update following a security breach that led to losses of around $116 million.
The report outlines how the incident occurred and the steps taken so far.
The attack happened on November 3 and affected two specific pool types within Balancer: v2 Stable Pools and Composable Stable v5 Pools.
Did you know?
Subscribe – We publish new crypto explainer videos every week!
What is Tezos? XTZ Cryptocurrency Easily Explained (ANIMATED)
According to the team, the attacker used a combination of transaction bundling, called BatchSwaps, and flash loans, which are short-term loans taken and repaid in a single transaction. The exploit relied on a flaw in the system’s rounding mechanism, used in certain types of token swaps.
Normally, this function rounds values downward, but the attacker was able to influence how rounding worked in their favor.
By combining the rounding flaw with the bundled transactions, the attacker was able to extract funds from the targeted pools. Balancer noted that, in many cases, the stolen assets were first held in the platform’s internal balance system before being moved out in later transactions.
Following the attack, Balancer worked with other blockchain security groups and protocol teams to recover or freeze some of the stolen assets. This included recovering about $19 million worth of StakeWise Staked ETH (osETH) and around $2 million in osGNO tokens.
To prevent further damage, Balancer has paused all affected pools and has temporarily stopped users from creating new pools of the same type.
A recent cyberattack targeting Seedify, a platform supporting Web3 gaming projects, resulted in the theft of around $1.2 million. How? Read the full story.
