Balancer hit by suspected $70M exploit with staked Ether tokens sent to new wallet

Update Nov. 3, 9:21 a.m. UTC: This article has been updated to include a section on the Balancer flash loan attack from 2020.

Decentralized exchange (DEX) and automated market maker (AMM) Balancer may have suffered an exploit, as about $70 million worth of digital assets was transferred to a freshly created wallet.

Onchain data shows that the protocol saw $70.9 million worth of liquid staked Ether () tokens transferred to a fresh wallet across three transactions, to Etherscan logs.

The transfers included 6,850 StakeWise Staked ETH (OSETH), 6,590 Wrapped Ether (WETH) and 4,260 Lido wstETH (wSTETH), crypto intelligence platform Nansen said in a Monday X .

While Balancer has yet to confirm the exploit, the millions flowing into the fresh signal that the transfers may have occurred due to a security breach.

Blockchain security firm Cyvers estimated that up to $84 million in suspicious transactions across multiple chains related to Balancer was involved, it wrote in a Monday X .

Related:

Two years ago, Balancer suffered a domain name system (DNS) attack on its front end website, the protocol on Sept. 20. Hackers redirected the website’s users to a phishing website associated with malicious smart contracts aiming to steal user funds.

About $238,000 worth of digital assets were stolen during the phishing attack, to blockchain sleuth ZachXBT.

In August 2023, Balancer also an almost $1 million stalecoin exploit, just a week after the protocol disclosed a “critical vulnerability” related to some of its liquidity pools. 

In June 2020, for $500,000 worth of Ether and other tokens as part of a flash loan attack based on the Statera (STA) deflationary tokens, where 1% of every transaction is automatically burned.

Cointelegraph has contacted Balancer and Nansen for comment on the ongoing exploit.

Magazine: