An attacker drained a Balancer V1 pool by compressing its WBTC reserves until the deposit required to mint pool tokens rounded down to a single satoshi, in an exploit that hit code deployed years ago and no longer actively maintained.
Security firm SlowMist put the loss at approximately $234,000 in a threat intelligence alert. The more consequential detail is where the flaw lives: the same join and exit math has been forked across DeFi, and the contracts are immutable.
This Is Not the November Exploit
The version matters, and readers who saw last year’s headlines will need the distinction.
The November 2025 exploit took roughly $128 million from Balancer V2 Composable Stable Pools across six networks. This incident hit Balancer V1—an earlier, separate codebase first deployed in 2020.
The two are different bugs, but they belong to the same class. V2’s flaw was a down-rounding operation in its _upscale function that caused swap logic to underestimate the input required. V1’s is a down-rounding in its join math that does the same thing. In both cases, fixed-point arithmetic rounded in a direction favoring the caller rather than the pool.
How the Rounding Failed
The flaw sits in joinswapPoolAmountOut, a Balancer V1 function that lets a caller specify how many pool tokens they want to receive rather than how much they want to deposit.
To determine the deposit required, the contract calls calcSingleInGivenPoolOut, which reverse-compute the input using 18-decimal fixed-point arithmetic. WBTC has eight decimals. When pool reserves are large relative to the requested output, that mismatch is harmless. When reserves are compressed toward zero, the computation rounds down to the smallest representable unit.
According to SlowMist, the attacker used nested flash loans from Spark or Aave, Morpho, and Uniswap V3 to fund public swaps that drove the pool’s WBTC reserves to dust. At that point the contract calculated a required input of one satoshi while minting the full amount of BPT—the pool’s liquidity token—requested. The attacker minted 4,408.8 BPT this way, then exited proportionally to withdraw DPI, USDC, WETH, and WBTC.
SlowMist identifies three missing checks: no minimum effective input, no minimum pool balance, and no relative-error validation. The contract’s _MIN_BALANCE constant is enforced only in the bind and rebind functions, which govern adding and adjusting tokens in a pool, not in the join path.
SlowMist names the attacker address as 0x338c7ec9befbb451d66fd8a468c32184f5689a41, the attack contract as 0x9caa8d0e44b22f50057d2f4ce0d1446529e11be3, and the vulnerable contract as 0x2257aaac34bcb27900291f7b84ee2565a6cbac57, alongside five transaction hashes.
Nobody Is Coming to Patch This
Balancer V1 contracts are not upgradeable. Whatever is deployed is what runs.
That would matter less if the code had an active maintainer. Balancer proposed returning about $8 million in recovered assets to liquidity providers after the November exploit, and the attacker began converting proceeds to Bitcoin through THORChain in April after five months of dormancy. Development attention since has been directed at V3, which implements explicit rounding controls with an enforced direction on every arithmetic operation.
V1 has been effectively dormant for years—still holding liquidity, still callable, still doing exactly what it was written to do in 2020.
The Fork Problem
Balancer V1’s BPool contract was among the most widely forked pieces of DeFi infrastructure of its era. The same join and exit math now runs in codebases with no connection to Balancer and no shared security process.
In June 2026, an attacker exploited Ocean Protocol BPool clones on Polygon through a logic error in single-sided join and exit accounting, flash-borrowing mOCEAN and cycling it through eight pools to extract a net profit, according to a technical write-up by DarkNavy. That was not the same flaw, but it lived in the same inherited math.
Two questions determine exposure, and both can be answered without waiting for anyone: does the pool hold a token with fewer than 18 decimals, such as WBTC or USDC, and is joinswapPoolAmountOut callable? A pool that answers yes to both, with reserves that can be pushed toward zero through public swaps, has the conditions this attack required.
The Crypto Times has contacted the Balancer team at 7:27 am UTC about which pool was affected, whether other V1 pools remain exposed, and who currently maintains the V1 codebase; this report will be updated with any response.
