A Balancer V1-style pool lost about $234,000 on August 31 to a rounding-error exploit, blockchain security firm Slowmist reported. The bug belongs to the same family that drained $116 million from Balancer's V2 pools last November, a hack that later pushed Balancer Labs to shut down as a company.
A Small Hack With a Familiar Signature
Blockchain security firm Slowmist flagged a fresh exploit against a Balancer V1-style pool on August 31, this time for a comparatively modest $234,000. Small as it is next to Balancer's history, the bug family is unmistakable.
It is a rounding error in how the protocol calculates token amounts during a swap — the same category of flaw that let an attacker drain $116 million from Balancer's V2 pools across multiple chains last November.
How the Exploit Worked
According to Slowmist's technical breakdown, the attacker targeted the pool's joinswapPoolAmountOut function, which lets a caller specify how many BPT (Balancer Pool Tokens) they want to receive, while the liquidity pool contract works backward to calculate the required input.
That reverse calculation uses 18-decimal fixed-point math. By running a series of public swaps, the attacker compressed the pool's WBTC reserves down to almost nothing. As a result, the math rounded the required input down to just 1 satoshi of WBTC, while the contract still minted the full amount of BPT the attacker requested.
Slowmist said the pool was missing basic safeguards that could have stopped this, including a minimum effective input, a minimum pool balance, and relative-error validation. The firm noted the contract's MIN_BALANCE check was only enforced during the bind and rebind functions, not during ordinary swaps, and it published both the attacker's wallet and the attack contract address.
Balancer's Long Shadow
In March, Balancer Labs, the company behind the protocol, announced it would shut down as a corporate entity, citing mounting legal exposure five months after the November 2025 exploit sent the protocol's total value locked tumbling from about $775 million to around $300 million. Co-founder Fernando Martinelli said at the time that the DAO would take over operations in a leaner form specifically to get out from under "the liability of past security incidents."
The wallet behind that original hack has stayed active too, resurfacing five months later to move 1,100 ETH through Thorchain. Today's exploit hit WBTC, a tokenized representation of bitcoin, rather than Balancer's own governance token, even as bitcoin's price sits comfortably near $78,000.
Source: Bitcoin.com News
Trading involves risk.
Risk Disclaimer
