Balancer Hacker Now Converting Loot to Ethereum: Stolen Funds Surge To $116.6M

Balancer, a major DeFi protocol, has suffered a significant exploit, with approximately $116 million drained from protocol vaults. On-chain data shows large, unusual outflows from Balancer’s “0xBA1…BF2C8” address to an external wallet, including 6,587 WETH (~$24.5M), 6,851 osETH (~$26.9M), and 4,260 wstETH (~$19.3M). The scale and nature of the transfers point to a coordinated attack involving high-value assets across multiple vaults.

Balancer has since confirmed the breach, stating that “around 7:48 AM UTC, an exploit affected Balancer V2 Composable Stable Pools.” According to the team, these pools have been live for several years, and some were outside the pause window, leaving them vulnerable. Pools that could be paused have been halted and are now in recovery mode, with the exploit confirmed to be isolated to V2 Composable Stable Pools. Balancer V3 and all other pools remain unaffected.

The protocol says it is working with leading security researchers and legal teams to investigate and will release a full post-mortem. Balancer also warned users about fraudulent communications circulating in the aftermath, emphasizing that official updates will only come through its verified X account and official Discord.

This incident marks one of the largest DeFi exploits of the year and has heightened security concerns across the sector.

According to Lookonchain, the Balancer exploiter has begun swapping the stolen assets for ETH, accelerating concerns that the attacker intends to consolidate and move value quickly before defenses or recovery mechanisms can engage. Converting large amounts of liquid-staking tokens and wrapped assets into ETH not only solidifies the hacker’s control over the stolen funds but also signals an intent to exit positions entirely rather than negotiate or return funds — a troubling sign for victims and the protocol.

This development is unfolding during one of the sharpest pullbacks the market has seen in recent months. Ethereum has fallen below $3,500, a key psychological and technical level, while Bitcoin has broken under the $105,000 support, intensifying fears of deeper downside as liquidity thins and sentiment deteriorates. Altcoins, already under pressure from macro-driven derisking, are bleeding heavily, with capital rotation stalling and speculative flows evaporating.

For Balancer, the timing compounds the severity of the crisis. A major security breach during a fragile market period magnifies losses, erodes confidence, and increases the risk of liquidity dislocations. The DeFi ecosystem is now closely watching both the hacker’s next moves and Balancer’s recovery plan as the sector navigates heightened stress on both technical and sentiment fronts.

BAL has entered another phase of sustained weakness, with the weekly chart showing a clear downtrend that has now intensified following the confirmed exploit. After trading near the $1 region for months, the token has broken lower, currently hovering around $0.80 and showing a sharp weekly decline. The chart reflects heavy selling volume, suggesting that the security breach accelerated an already fragile market structure.

Technically, BAL remains below the 50-week and 200-week moving averages, reinforcing a long-term bearish trend with no immediate signs of reversal. Each attempt to establish support has been met with lower highs and breakdowns, indicating persistent distribution and a lack of sustained buyer interest. The recent spike in volume during the selloff confirms capitulation behavior rather than accumulation, as fear spreads across the DeFi sector.

Market sentiment around BAL has deteriorated further given the exploit’s timing. With Ethereum trading below $3,500, Bitcoin losing key support near $105,000, and altcoins bleeding across the board, risk appetite is at a low point. For BAL to show recovery signals, it would need to reclaim psychological support near $1 and stabilize volume flows. Until then, price action remains vulnerable, and further downside cannot be ruled out as confidence rebuilds slowly.

Featured image from ChatGPT, chart from TradingView.com