How a Developer Comment Aged Into a $128M Catastrophe: The Balancer Rounding Exploit
Buried in Balancer's smart contract code, right above the function that would eventually hemorrhage $128 million, sat a developer comment: "the impact of this rounding is expected to be minimal." They were wrong — by nine figures.
On November 3, 2025, an attacker exploited a microscopic rounding error in Balancer V2's Composable Stable Pools, draining funds across nine blockchain networks in under 30 minutes. It was not a flashy reentrancy attack or a compromised private key. It was arithmetic — the kind of bug that hides in plain sight, passes multiple audits, and waits patiently for someone clever enough to weaponize it.