Balancer V1 BPool attack drains about $234,000 as project warns LPs

  • An attacker drained approximately $234,000 from a Balancer V1 BPool on August 31 via a rounding exploit.
  • Flash-loan manipulation compressed WBTC reserves to dust, minting 4,408.8 BPT for one satoshi.
  • Balancer Labs shut down in March 2026 after a prior $116 million V2 hack; V1 pools are immutable and unpatchable.

A Balancer V1 pool was drained approximately $234,000 on August 31 through a rounding-error exploit in joinswapPoolAmountOut and calcSingleInGivenPoolOut after an attacker used nested flash loans to compress WBTC reserves toward zero. The math rounded the required input down to one satoshi of WBTC while minting 4,408.8 BPT. Balancer Labs shut down as a company in March 2026 after a similar November 2025 incident drained $116 million from V2 pools. The legacy V1 contracts are immutable and cannot be patched or paused, leading Balancer to urge liquidity providers to exit through the legacy withdrawal interface. The incident highlights risks in forked DeFi pool logic and the difficulties of maintaining deprecated code.

The information on this website is generated using AI and we cannot guarantee its accuracy. Please use it as reference information only.