Balancer
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5qg8TK…nMc1Summary
Balancer is a decentralized automated market maker (AMM) protocol on Ethereum, founded in 2018 by Fernando Martinelli and Mike McDonald, that allows multi-token liquidity pools with customizable weighting. The protocol has suffered six documented security incidents between 2020 and 2025, resulting in cumulative losses exceeding $140 million, including a catastrophic $128 million exploit in November 2025 caused by an arithmetic precision flaw in Composable Stable Pool contracts. Despite multiple audits by major firms including Trail of Bits, OpenZeppelin, and Certora, systemic smart contract vulnerabilities and a highly complex protocol architecture have repeatedly exposed user funds to loss.
Connected Entities
1 entities- + 3 more
Timeline(13 events)
2018
Balancer protocol research begins at BlockScience as an R&D project.
March 2020
Balancer Labs raises $3 million in seed funding and launches Balancer V1 mainnet.
June 2020
BAL governance token launches; 25 million tokens allocated to founders and investors, 65 million to liquidity providers.
28 June 2020
Deflationary token flash loan exploit: attacker uses dYdX flash loan to drain STA and STONK pools. Approximately $523,600 stolen. Balancer reimburses affected users.
April 2021
Balancer V2 launches with unified vault architecture, separating pool logic from asset custody.
13 March 2023
Euler Finance is exploited for $197 million. Balancer's bb-e-USD pool suffers approximately $11.9 million in indirect losses. Emergency subDAO pauses the pool.
22 August 2023
Balancer publicly discloses a critical vulnerability in V2 boosted pools and urges liquidity providers to withdraw funds. Approximately $2.8 million estimated at risk.
25 August 2023
Balancer reports 99.7% of at-risk liquidity withdrawn; approximately $565,199 still in vulnerable pools.
27 August 2023
Attackers exploit the disclosed August 22 vulnerability via flash loans, draining over $2.1 million across eight networks.
19 September 2023
Balancer frontend compromised via social engineering attack on EuroDNS registrar and BGP hijacking. Approximately $253,044 stolen from users who interacted with malicious front-end across six networks.
20 September 2023
Balancer DAO successfully recovers control of compromised domain by approximately 5:45 pm UTC.
2 June 2024
Velocore, a Balancer-fork DEX, is exploited for approximately $6.8 million on Linea and zkSync Era due to faulty logic in its ConstantProductPool contract.
3 November 2025
Balancer V2 suffers its largest-ever exploit: approximately $128.64 million drained across six blockchain networks in under 30 minutes via a rounding error in _upscaleArray() within ComposableStablePool contracts. Safe Harbor recoveries begin within hours.
Decision Log
- hash: 8iCxQ2z4f6gnTURRA5sULmGjmwJnKBGRo7VqKieRrzVZ
- hash: AF9BbupBDjv4dLPmziLmBHZsJXxD6CSgFiTJzZMRaXxj
- hash: AeKRaviyDCZYtAmavueQX8FGwg34vkzehCyUy8x6uZ3w
- hash: 8enS2oHxwQJ9R7b19zoSwZuWTLxf9JqNoL7k1gZ5N5uC
- hash: F64nJcNu71zo2t9saVQyeHfNmfA3BV6jqGgfRL29cHUp
This investigation is cryptographically anchored to the Solana blockchain (5 events). 0 of 30 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 7:10:50 PM
last updated: 8/29/2026, 1:35:16 AM
avoid.net — verified advice for a post-truth world