Balancer’s $120M Meltdown: How A Series of Small Swaps Almost Broke a Top AMM

The Balancer v2 exploit on November 3rd resulted in losses of around $120 million across its main protocol and multiple forks. According to the SlowMist security team’s post-incident analysis, the exploit stemmed from a precision loss flaw in the integer fixed-point arithmetic used to calculate scaling factors inside Composable Stable Pools, which are designed for near-parity asset pairs such as USDC/USDT or WETH/stETH.

In the latest update, SlowMist confirmed that this flaw caused small but consistent price discrepancies during swaps, especially when attackers used the batch swap function to chain multiple operations within a single transaction. The attackers’ strategy was executed across several steps.