Balancer releases preliminary report on the vulnerability incident: the vulnerability was exploited due to a rounding error in bulk exchange transactions.

Balancer released a preliminary report on the vulnerability attack, stating that its Balancer V2 composable stable pool was attacked on multiple chains (including Ethereum, Base, Avalanche, Polygon, Arbitrum, etc.) on November 4th. The vulnerability stemmed from a rounding logic error in the EXACT_OUT transaction within batchSwap, which attackers exploited to manipulate pool balances and withdraw assets. This incident only affected Balancer V2's composable stable pool; Balancer V3 and other pool types were unaffected. The Balancer team, along with security partners and white-hat teams, acted swiftly, successfully containing the attack and recovering some assets through measures such as Hypernative automatic suspension, asset freezing, and white-hat intervention under the SEAL framework. StakeWise recovered approximately 73.5% of the stolen osETH, and teams such as BitFinding and the Base MEV bot also assisted in recovering some funds. Currently, Balancer is collaborating with security partners such as SEAL and zeroShadow on cross-chain tracking and fund recovery. The final verified loss and recovery data will be published in a full technical review report. The official reminder to users: Only obtain confirmed information through official Balancer channels; V3 and non-stable pool operations remain safe.