Decentralized finance protocol Balancer is moving to reimburse a fraction of the funds stolen in a USD $128.6 million exploit, relying on a tailored recovery plan and white-hat hacker assistance.
The platform has proposed a plan to distribute approximately USD $8 million in recovered assets to users affected by the attack that occurred in early November. This amount represents a small portion of the total funds drained from its vaults.
Balancer confirmed that about USD $28 million in total assets were recovered. However, USD $19.7 million of these funds, consisting of osETH and osGNO tokens, remain under the management of the liquid staking protocol StakeWise.
The exploit targeted a vulnerability within Balancer V2 Composable Stable Pools. Attackers were able to drain tokens, affecting liquidity providers who held assets in these specific vaults.
The reimbursement model is non-socialized, meaning only liquidity providers operating in the directly affected pools will receive funds. Distributions will be proportional to the Balancer Pool Tokens (BPT) each user held at the time of the exploit.
Users will receive “payment in kind,” meaning they will get back the same types of tokens that were successfully recovered during rescue operations. This approach aims to prevent distortions in protocol governance and maintain the original composition of affected assets.
Six white-hat hackers participated in rescue efforts during the attack. These collaborators are eligible for rewards of up to 10% of the value they recovered, with a cap of USD $1 million per operation.
One hacker, identified as “Anon #1,” completed the largest rescue, recovering USD $2.68 million on the Polygon network. Another, “Bitfinding,” secured USD $963,832 on the main Ethereum network, with additional smaller amounts rescued on Base and Arbitrum.
To claim rewards, white-hat hackers must complete identity verification, Know Your Customer (KYC) checks, and sanction list validations through Balancer’s SEAL Safe Harbor agreement. Collaborators who recovered funds on Arbitrum chose to waive their rewards to maintain anonymity.
Affected beneficiaries have a 180-day period to claim their tokens. After this timeframe, any unclaimed funds will become inactive and will require a governance decision to determine their future use. The Balancer team states this structure ensures transparency, fairness, and legal certainty for all affected users.