Balancer V1 pool loses $234,000 in exploit

• A Balancer V1 pool was exploited, with about US$234,000 in assets reportedly drained.
• The attack targeted a calculation error in the pool’s joinswapPoolAmountOut function.
• The exploit used flash loans and affected assets including WBTC, USDC, WETH and DPI.

A Balancer V1 pool was exploited, with about US$234,000 in crypto assets reportedly drained.

Security firm SlowMist linked the attack to a calculation error in the pool’s joinswapPoolAmountOut function.

The attacker reduced the pool’s WBTC (CRYPTO:WBTC) balance before exploiting the calculation and minting 4,408.8 Balancer Pool Tokens.

The attacker reportedly needed about one satoshi of WBTC to mint the pool tokens after manipulating the calculation.

Those tokens were then used to withdraw DPI, USDC (CRYPTO:USDC), WETH (CRYPTO:WETH) and WBTC from the pool.

Flash loans from Spark, Aave, Morpho and Uniswap V3 reportedly provided funds for the attack.

SlowMist identified missing minimum-input and minimum-balance checks as key weaknesses in the affected pool.

Balancer V1 is an older version of the protocol, and the reported exploit targeted a V1 BPool rather than Balancer’s broader system.

At the time of reporting, Wrapped Bitcoin price was $78,016.61.