Balancer Hack Update: Exploiter Begins Selling Stolen Tokens After Protocol Recovered $4.1M

The attacker behind the Balancer hack has begun to move and sell the stolen assets. The developments come after the protocol announced the recovery of $4.1 million of the funds.

Exploiter Moves Millions as Balancer Hack Recovery Ongoing

Data has shown that 6,999 ETH was moved from the wallet of the Balancer exploiter to a new address, according to Arkham Intelligence. The move is considered by experts to be the attacker’s preparation to cash out while Balancer work to limit further losses.

This is in line with earlier “test transactions,” including one transfer of 1 ETH. Attackers tend to do to confirm the routing paths before they start selling off the tokens. 

This comes after the Balancer team confirmed that it recovered around $4.1 million following the discovery of a new attack vector in its system. Investigations indicate that this bug came from an upscale function of the protocol. 

In connection with the recent Balancer V2 stable-pool incident, a new value-extraction path was identified in V2 meta-stable pools. In coordination with @CertoraInc and @_SEAL_Org , Balancer team initiated a whitehat recovery around 7PM UTC and has secured ~$4.1M to controlled…

— Balancer (@Balancer) November 12, 2025

The attacker has built exact amounts of swaps that gave minute-precision losses. With that repeated in multiple operations, it resulted in meaningful profit. This method was different from the previous hacks.

Shortly after, StakeWise recovered 19.3 million osETH drained during the Balancer Hack. The company called a smart contract to recover 5,041 osETH and reduced the net stolen amount from $117 million to $98 million.

The recovery efforts have allowed the resumption of operations on some of the platforms. Stader Polygon announced that unstaking for MaticX had been restored. They said the temporary pause was put in place to prevent the exploiter from being able to access liquidity during this recovery process. 

Update for MaticX users‼️

Unstaking is now live again!

We had temporarily paused unstaking as a precautionary step to stop the Balancer exploiter from withdrawing funds while the Balancer & Polygon teams coordinated recovery efforts.

We’d like to reiterate that MaticX… https://t.co/7vZ8xQsKT1

— Stader Polygon (@stader_polygon) November 13, 2025

Top Crypto Hacks In 2025

The Balancer Hack joins a list of high-profile breaches that happened in the crypto market this year. For instance, in May, the Cetus Protocol lost $260 million in an exploit.

The investigators found a wallet linked to the attacker that held 12.9 million SUI. This wallet then sent the funds through USDC and moved them to Ethereum to convert them into ETH.

Early in the year, Bybit was hit with a security breach involving digital assets of over $1.4 billion. Analysts noticed that a number of ETH withdrawals happened from addresses linked to funds received from the exchange’s wallets.

Centralized trading platform BigONE also confirmed that hackers stole $27 million by breaking into its hot wallet. The stolen funds were in different assets, including BTC, ETH, USDT, SHIB, SOL, and DOGE.