Balancer V1 Exploit Exposes Limits of DeFi Balance Monitoring

A Balancer V1 exploit routed more than $1 billion in flash-loan assets through Aave, highlighting how balance checks can miss large flows that disappear before review.

The attacker used the borrowed assets as collateral across three Aave V3 markets, borrowed another $788 million, exploited Balancer V1 and closed the positions before each transaction ended. The Balancer V1 loss was roughly $250,000, and Aave suffered no loss.

The Aave positions closed within the same transactions; the address had effectively no balance in those markets just before or after the activity. Periodic balance checks may miss assets that pass through a market and are returned before the next review.

Earlier funding for the address traced to Tornado Cash.

The first transaction in a broader Balancer V1 exploit episode occurred Aug. 30 at 10:23:23 p.m. ET (Aug. 31 at 02:23:23 UTC). Copycat activity followed across 120 pools, with $1,393,694.67 in tokens drained at attack-time prices. The roughly $250,000 estimate and the episode-wide tally cover different scopes.

Balancer V1 is legacy code that is immutable, unmaintained and has no pause mechanism. Balancer holders have approved a protocol wind-down plan.