Balancer announces that due to vulnerabilities in DeFi pools, $27 million may be at risk

The vulnerability has not yet caused any actual losses, but the project has revealed that some funds may still be at risk.

DeFi platform Balancer (BAL) disclosed a vulnerability affecting multiple of its pools in a statement released on August 22.

In that article, Balancer Labs stated that the relevant vulnerability had not been exploited and that 80% of the issue had been mitigated. However, the project acknowledged that a small amount of funds—about 4% of its total locked value (TVL)—remain at risk.

Data from DeFiLlama shows that Balancer's current TVL is $691 million, meaning approximately $27 million is at risk.

To address this issue, Balancer's emergency SubDAO enabled proportional withdrawals from affected pools and paused certain pools. Balancer urged users to migrate funds to safe pools or withdraw their funds; it also urged liquidity providers to exit risky pools.

Since the announcement, a large number of withdrawals have occurred. Over the past few hours, about $149 million has been withdrawn from Balancer's TVL, but it is unclear whether these funds have been removed from the risky pools.

The project has not released a full post-mortem analysis of the vulnerability nor disclosed the source of the initial report.

DeFi platforms face the risk of exploitation

Balancer has been targeted by hackers or faced risks in other incidents. According to Peckshield, an attacker stole over $500,000 from Balancer in 2021.

One Balancer pool was also affected by the broader attack on Euler Finance in March 2023, when Balancer paused affected assets and pools; although $119 million was impacted, it is unclear whether this amount was ultimately lost. Balancer also disclosed a vulnerability and recommended some liquidity providers exit pools in January 2023.

This year, DeFi platforms have experienced thefts totaling hundreds of millions of dollars. A recent analysis indicates that so far in 2023, $77 billion has been stolen.