The $116 million hack on Balancer, a popular decentralized exchange, appears to have been months in the making. The attacker carefully used Tornado Cash to hide their trail, sending 0.1 ETH deposits to stay unnoticed. As a result, blockchain experts said the method showed strong planning and skill.
Conor Grogan, director at Coinbase, said the hacker had over 100 ETH stored in Tornado Cash.“Hacker seems experienced: seeded account via 100 ETH and 0.1 Tornado Cash deposits. No opsec leaks,” he posted on X. Grogan added that such large funds in privacy mixers are rare, hinting at links to past hacks.
Soon after, Balancer confirmed the exploit on Monday and offered a 20% bounty for the return of stolen assets. “Our team is working with leading security researchers to understand the issue,” the project wrote on X. Furthermore, the company said only its older V2 Composable Stable Pools were affected, while newer pools remained safe.
Additionally, Deddy Lavid, CEO of Cyvers, called it one of the “most sophisticated attacks of 2025.” He said the attacker bypassed control layers to change asset balances, calling it a failure in governance, not protocol design. Lavid also urged projects to use real-time monitoring instead of relying only on audits.
Consequently, the hack hit the DeFi world hard. Curve Finance, another major project, said on X, “It’s very heartbreaking to see OG DeFi projects being exploited. Really wish the Balancer team to recover the assets.” Curve confirmed its own safety and advised developers to “check your math” and design systems that forgive small mistakes.
Moreover, the theft included tokens like WETH, osETH, and USDC across Ethereum, Polygon, and Base networks. Blockchain trackers Lookonchain and PeckShieldAlert reported that total losses reached $116.6 million within hours.
Berachain also paused its network after detecting related risks. Security teams said the move was temporary while they worked on fixes.
Also Read: Tether Reports $10B Profit and Record U.S. Treasury Holdings
