TLDR
- Berachain executed an emergency hard fork to trap hacker funds after the Balancer V2 exploit.
- The Balancer breach resulted in the theft of over $128 million from its Composable Stable Pools.
- The Berachain Foundation confirmed that validators have upgraded and the chain remains paused for stability checks.
- The attacker exploited a flaw in Balancer’s manageUserBalance function to withdraw unauthorized funds.
- StakeWise recovered 5,041 osETH worth about $19.3 million, reducing total stolen assets to around $98 million.
Berachain has executed an emergency hard fork to contain the fallout from the Balancer V2 exploit. The network trapped the hacker’s funds after over $128 million was drained from Balancer’s Composable Stable Pools. The chain’s core team confirmed the move as part of a coordinated recovery plan.
Emergency Action to Contain Breach
Berachain distributed the hard fork binary to validators who upgraded quickly to secure the network. The foundation confirmed that chain liveness remains paused as stability checks continue. The team stated,
“Prior to going live and producing blocks once again, we’d like to ensure that core infrastructure partners have updated their RPCs.”
The foundation added that oracles, bridges, and custodians will reconnect only after full validation. The pause allows infrastructure partners to prepare for safe resumption of operations. The measure aims to secure affected funds and restore operational reliability.
The emergency step came after Balancer suffered one of the largest DeFi exploits this year. Security firm PeckShield flagged the attack within hours of detection. The attacker drained multiple assets, including wrapped Ether (WETH), osETH, and wstETH, from Balancer’s V2 smart contracts.
Balancer Exploit and Fund Movement
The breach targeted Balancer’s authorization logic through a vulnerability in its manageUserBalance function. The flaw allowed the attacker to impersonate users and withdraw internal balances without permission. Analysts from Defimon Alerts and Decurity confirmed the exploit details in their investigations.
On-chain data reviewed by Nansen revealed large asset transfers to a new wallet. The attacker converted stolen tokens into Ethereum before moving them through Tornado Cash. Cyvers Alerts observed these laundering attempts shortly after the exploit began.
However, liquid staking protocol StakeWise recovered 5,041 osETH worth about $19.3 million. This reduced total stolen assets to around $98 million. More than half of those funds had already been converted into ETH before the recovery.
Berachain Coordinates Recovery with White Hat
Berachain reported that an MEV bot operator currently holds the compromised funds. The operator identified himself as a white hat and agreed to return the assets. The foundation said he will “pre-sign transactions to transfer the funds back upon the chain going live.”
The recovered funds will return to the Berachain deployer address 0xD276D… once the network resumes activity. The team has sent on-chain messages to confirm and authenticate the return process. Validators and partners are coordinating to ensure secure fund restoration.
Berachain stated that stability remains its top priority as it finalizes infrastructure updates. The chain will only resume block production after all validators and key partners complete necessary changes. The coordinated action aims to prevent further unauthorized fund movement.
Audits and Broader Context
Despite extensive audits, Balancer’s V2 contracts failed under this exploit. The protocol had previously undergone over ten audits from OpenZeppelin, Trail of Bits, and Certora. Developer Suhail Kakar commented that “code is hard, DeFi is harder,” reflecting ongoing security challenges.
Balancer has faced multiple attacks since its 2020 launch. Past incidents include a $520,000 loss due to a token flaw in 2020 and a $2.1 million exploit in 2023. A DNS hijack later that year also disrupted the protocol.
Following the latest breach, Balancer’s total value locked dropped sharply. DeFiLlama data shows TVL plunged from $442 million to around $213 million in one day. Berachain continues working with partners to stabilize operations before reactivating the network.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
