The team behind decentralized finance (DeFi) protocol Balancer published a preliminary post-mortem report on Wednesday, detailing the cause of the exploit that siphoned $116 million across DeFi markets.
Balancer was hit by a sophisticated code exploit on Monday that affected Balancer v2 Stable Pools and Composable Stable v5 pools, while all other pool types remained unaffected, according to the report.
The hacker used a combination of BatchSwaps, which allow the user to bundle multiple actions in a single transaction, including flashloans — short-term loans borrowed and repaid within the same transaction — and an exploit of the upscale rounding function that affects EXACT_OUT swaps in the Stable Pools.
The rounding function is intended to round down when token prices are an input. However, the hacker was able to manipulate these rounding values, and in conjunction with the BatchSwap feature, drained funds from the stable pools. The team wrote:
“In many instances, the exploited funds remained within the Vault as internal balances before being withdrawn in subsequent transactions.”
The hack serves as a reminder that hot wallets, liquidity pools and onchain funds exposed to the internet are vulnerable to evolving cybersecurity threats from hackers, prompting crypto users and blockchain developers to practice caution in protecting funds.
Related: Balancer audits under scrutiny after $100M+ exploit
Balancer responds to the $116 million hack with the help of the crypto industry
The hackers were likely skilled professionals who prepared for months before executing their attack, using a series of 0.1 Ether (ETH) Tornado Cash deposits to fund the attack to avoid detection, Cointelegraph previously reported.
Balancer worked with cybersecurity partners and crypto protocols to claw back or freeze a portion of the stolen funds, including 5,041 StakeWise Staked ETH (osETH), valued at about $19 million, and 13,495 osGNO tokens valued at up to $2 million.
The team has paused all affected pools and disabled the creation of new “vulnerable” pools until the security issue is fixed.
Balancer offered a 20% white hat bounty to ethical hackers and the perpetrator for the return of the stolen funds, but no one had claimed the bounty as of this writing.
Magazine: ‘SEAL 911’ team of white hats formed to fight crypto hacks in real time
