Berachain Recovers $12.8M After Balancer Protocol Exploit

TLDR

• Berachain Foundation recovered the full $12.8 million lost in the Nov. 3 Balancer V2 exploit through cooperation with a white-hat hacker.
• The recovery was achieved by halting the network and executing an emergency hard fork to freeze the attacker’s assets.
• Over 1,000 affected Berachain users will receive their funds back through a redistribution system matching original wallet addresses.
• The Balancer exploit drained approximately $128 million across multiple blockchain networks including Ethereum, Arbitrum, Base, and Polygon.
• BERA token dropped 10% after the hack but recovered following the successful fund recovery announcement.

Berachain Foundation announced on Nov. 4 that it successfully recovered $12.8 million stolen during the Balancer V2 protocol exploit that occurred on Nov. 3. The funds were returned to the foundation’s deployer wallet after coordination with a white-hat hacker.

The recovery came after Berachain executed an emergency hard fork to freeze the attacker’s assets. The chain’s validators halted operations within hours of detecting the breach. The foundation worked directly with an MEV bot operator who had been active on the network for several months.

The operator identified themselves as a white-hat hacker and agreed to return the stolen funds. They pre-signed a set of transactions to transfer the assets back once the chain resumed operations. The Berachain Foundation stated it would consider offering a bounty in appreciation for the cooperation.

Network Restoration Process

Berachain temporarily suspended all swaps, deposits, and withdrawals immediately after the exploit. The foundation cited ongoing concerns about the underlying Balancer vulnerability. The team coordinated with infrastructure partners to ensure network stability before restarting operations.

Core infrastructure including oracles for liquidations required RPC updates before the chain could resume block production. Bridges, centralized exchanges, and custodians were reconnected after the network restarted. The foundation began unpausing key functions including HONEY minting and redemption.

More than 1,000 users were affected by the exploit on Berachain. The foundation implemented a redistribution system to return recovered funds. The system matches deposits to original wallet addresses to ensure proper distribution.

The Balancer exploit targeted the protocol’s V2 Composable Stable Pools on Nov. 3. Security firm PeckShield identified it as one of the largest DeFi exploits of 2025. The attack drained approximately $128 million in assets across seven blockchain networks.

Technical Details of the Exploit

The vulnerability existed in Balancer’s “manageUserBalance” function. Analysts at Defimon Alerts and Decurity identified a precision error in the authorization logic. The flaw allowed the attacker to impersonate other users and withdraw internal balances without proper authorization.

The stolen assets included wrapped Ether, osETH, and wstETH. More than half of the stolen funds were quickly converted to ETH. On-chain data from Nansen tracked suspicious transfers to a new wallet address.

Cyvers Alerts reported the attacker began laundering funds through Tornado Cash. Balancer entered recovery mode and offered a 20% white-hat bounty worth $25.6 million. The protocol gave the attacker 48 hours to return the funds.

Liquid staking platform StakeWise recovered approximately $20 million in stolen assets through a contract call. This reduced the total stolen amount to around $98 million. Berachain was affected through BEX, its Balancer fork implementation.

Balancer had undergone nine audits on its vault system before the exploit. Top security firms including OpenZeppelin, Trail of Bits, and Certora had reviewed the code. Developer Suhail Kakar noted that repeated audits no longer guarantee complete security.

The BERA token declined 10% immediately following news of the exploit. The token recovered its losses after the foundation announced the successful fund recovery. Balancer’s total value locked dropped from $442 million to $213 million within 24 hours according to DeFiLlama data.

Berachain operates as a Cosmos-based Layer-1 network using proof-of-liquidity consensus. The network’s ability to execute an emergency hard fork proved crucial in trapping the stolen funds. StakeWise successfully recovered 5,041 osETH worth roughly $19.3 million during the same incident.

The post Berachain Recovers $12.8M After Balancer Protocol Exploit appeared first on CoinCentral.