Leaderboard
770All-time rank
B

Balancer

Jun 28, 2020

$500K
Lost
$500K
Recovered
$0
Net loss
$500K
Unrecovered0% recovered

Balancer pools holding deflationary tokens (like STA which burns 1% per transfer) were exploited. An attacker used a dYdX flashloan to repeatedly trade between STA and ETH, depleting STA to 1 wei while Balancer's balance tracking failed to account for the fee burns.

They extracted ETH, WBTC, LINK and SNX from severely imbalanced pools.

How the exploit worked

View reproducible PoC

Token Incompatible.

Source: DeFiHackLabs (SunWeb3Sec)

Target
DeFi
Classification
Token & Share Accounting
Technique
Incorrect Share Accounting
Attribution
Unknown
Chains
Ethereum

Event timeline

  1. Jun 28, 2020
    Exploit executed — $500K drained via incorrect share accounting
  2. Attributed to Unknown
  3. Recovery status Unrecovered 0%

Data credits

Related incidents