A cyberattack on the decentralized finance (DeFi) protocol Balancer, resulting in losses of approximately $116 million, is suspected to be the culmination of meticulous, months-long planning by highly skilled perpetrators.
On-chain analysis of the exploiter's transactions reveals a high degree of sophistication. The attacker reportedly utilized advanced methods, including repeatedly depositing small amounts of 0.1 Ether (ETH) from the cryptocurrency mixer Tornado Cash to evade detection.
Conor Grogan, director at Coinbase, highlighted the hacker's professionalism. He noted that the perpetrator had at least 100 ETH stored in Tornado Cash smart contracts, suggesting potential links to previous exploits. Grogan added that users rarely store such large sums in privacy mixers, further reinforcing the attacker's professional nature.
In response to the incident, Balancer has offered a 20% white hat bounty to the perpetrator if the stolen funds are returned in full, minus the reward.
Deddy Lavid, co-founder and CEO of blockchain security firm Cyvers, described the Balancer exploit as one of the most sophisticated attacks seen. Lavid stated:
- "The attackers bypassed access control layers to manipulate asset balances directly, a critical failure in operational governance rather than core protocol logic."
- He emphasized that static code audits are no longer sufficient and called for continuous, real-time monitoring to flag suspicious flows before funds are drained.
The incident also bears resemblances to the extensive preparations undertaken by notorious hacking groups like the Lazarus Group, known for pausing illicit activity for months ahead of major attacks, such as the $1.4 billion Bybit hack.