Balancer V1 Exploit: How a $250K Hack Used $1 Billion in Flash Loans

Quick answer: In early September 2026, an attacker drained roughly $250,000 from Balancer V1 pools, a legacy version of the protocol that can no longer be patched or paused. What made it notable wasn’t the size of the loss. It was the financing. According to blockchain security firm Blockaid, the attacker moved more than $1 billion in flash loans through three Aave V3 markets, borrowed a further $788 million against it, and unwound everything inside the same transactions. Aave reportedly lost nothing. But any monitoring tool that only checks wallet balances would have seen almost nothing happen.

Blockaid published its write-up on October 22, which is why the story is circulating now, about six weeks after the exploit itself. Here’s what’s confirmed, what rests on Blockaid’s own account, and what it means if you hold DeFi positions or old liquidity-pool tokens.

What happened to Balancer V1

Balancer is an automated market maker where users deposit tokens into pools and traders swap against them. Version 1 is the oldest generation. It’s been superseded by newer versions, but some pools still hold funds, and because V1 was deployed without admin controls, nobody can pause it or push a fix.

That matters because the weakness showed up in public first. On August 31, 2026, SlowMist flagged a precision flaw in two V1 functions, joinswapPoolAmountOut and calcSingleInGivenPoolOut. As relayed by BlockTempo and republished by KuCoin, an attacker used nested flash loans to shrink one pool’s WBTC reserve to about 1 satoshi, then received 4,408.8 Balancer pool tokens for a negligible deposit. Those tokens were redeemed for the pool’s DPI, USDC, WETH and WBTC. That first incident cost about $234,000. SlowMist’s assessment was that V1 lacked a minimum deposit, a minimum pool balance and relative error checks.

Blockaid says a copycat wave followed. By its account, other people were already draining remaining pools by the time the September 6 attack happened, and that attack took about $250,000.

Neither figure is large by 2026 standards. Our own coverage of price manipulation exploits this year shows how much bigger the losses can get. The interesting part is how the September 6 attack was funded.

The $1 billion that never stayed

A flash loan is a loan that must be borrowed and repaid inside a single transaction. If the repayment doesn’t happen, the whole transaction reverses as though it never occurred. That lets anyone borrow sums they could never put up as collateral, as long as the trade they make with them pays for itself before the block ends.

Blockaid’s post lays out this sequence:

• The attacker raised more than $1 billion through flash loans.
• The funds were supplied as collateral across three Aave V3 lending markets (Blockaid doesn’t name which ones).
• The attacker then borrowed another $788 million against that collateral.
• The exploit ran against Balancer V1.
• Every position was closed before each transaction finished.

Blockaid also says the gas cost of the whole operation was roughly $4. That number comes from the firm’s own post and we couldn’t confirm it independently, so treat it as indicative rather than verified.

If you want a refresher on how the lending side works, our guide to Aave and Compound covers collateral, borrowing limits and flash loans in plain terms.

Why Aave wasn’t the victim

It’s easy to read “$1 billion through Aave” and assume Aave was hit. It wasn’t. Both Blockaid and the outlets covering it say Aave suffered no loss, and Blockaid describes its markets as working as designed. They supplied temporary leverage. The loss sat entirely with Balancer V1 liquidity providers.

That distinction is the whole point of composability, for better and worse. Lending markets, exchanges and liquidity pools are all open building blocks. An attacker can chain them in one transaction without anyone’s permission. Each piece can be behaving correctly while the combination does something none of the designers planned for.

The real argument: monitoring that watches balances misses this

Here the story moves from hack to compliance. Blockaid sells risk monitoring products, so keep in mind that its conclusions double as a pitch. With that said, the technical observation is fair.

Many monitoring systems check what an address holds at a point in time, typically at the end of a block. The attacker’s wallet held effectively nothing in the affected Aave markets in the blocks before and after the activity. A balance snapshot would show an empty wallet. The billion dollars of movement exists only in the transaction trace.

Blockaid also says it flagged the attacker’s address hours before the attack, because the address had been funded from Tornado Cash. And one of its customers, which monitored an affected Aave market, received an alert once the market’s exposure to stolen funds crossed a set threshold. The alert opened an incident and recommended avoiding trades against that market or exiting the position. All of that detection detail is Blockaid’s own account. Both outlets that covered it said as much, and no third party has verified it.

The firm’s bigger worry is sanctions. If a sanctioned entity routed funds through a lending market the same way, the on-chain footprint would look identical, but the legal exposure for the platforms and users involved would be very different. Blockaid notes that OFAC liability is strict, while regulators also look at whether a compliance program was reasonably designed to catch this kind of activity. Its recommendations include tracking value flows (supply in, borrowing out) rather than only current holdings, setting per-market exposure thresholds, and keeping audit-ready records.

What remains unclear

A few things aren’t settled, and it’s better to say so than guess.

• The chain. Neither article names it. Blockaid’s linked transaction and the assets involved point to Ethereum, but that’s inference.
• Recovery. No coverage reports any recovered funds or recovery effort.
• Official post-mortems. One report says Balancer governance bodies and the security committees of involved protocols are expected to publish detailed post-mortems in the final week of October. We found only one outlet making that claim, so don’t count on the timeline until a primary announcement appears.
• Attribution. The August 31 and September 6 attacks may or may not be the same actor. The sources don’t say.

A realistic scenario

Imagine you provided liquidity to a Balancer pool back in 2021 and haven’t looked at it since. The tokens are still sitting in your wallet, the pool still shows a balance on a portfolio tracker, and you assume that’s the end of it. Nothing alerts you, because V1 has no admin and no one is watching on your behalf. The next time anyone thinks about that pool might be when it’s already been drained.

That’s the uncomfortable thing about immutable legacy contracts. The “no one can change this” promise cuts both ways. It protects users from rug pulls and also prevents anyone from stepping in when a flaw is found.

What to do about it

• Audit your own old positions. Check connected-wallet approvals and any liquidity positions you opened years ago. Withdraw from deprecated pools if they still hold funds.
• Don’t assume age equals safety. A contract that survived for years can still carry a rounding bug that only becomes exploitable once flash loans make extreme pool states cheap to reach.
• Remember audits have limits. Our explainer on what smart contract audits do and don’t catch covers why code can be technically correct yet economically exploitable.
• Use official channels. Wait for the protocol’s own post-mortem before acting on social media claims about recovery or compensation.

Frequently asked questions

How much was stolen in the Balancer V1 exploit?

About $250,000 on September 6, 2026, according to Blockaid. An earlier incident on August 31 cost roughly $234,000, according to SlowMist’s alert as relayed by BlockTempo.

Did Aave lose money?

No. Blockaid and the outlets covering the report say Aave reported no losses. Its markets provided the temporary leverage.

Why couldn’t Balancer just fix V1?

Blockaid describes V1 as deprecated, with pools that can’t be patched or paused. Immutable contracts can’t be upgraded after deployment.

What is a flash loan?

A loan borrowed and repaid within a single transaction. If it isn’t repaid, the transaction reverts. It’s used legitimately for arbitrage and refinancing and also in many exploits.

Is my money in Balancer at risk today?

The reported flaw concerns V1 pools specifically. If you hold positions in them, check them and consider withdrawing. We haven’t seen reporting on exposure in newer Balancer versions, so check Balancer’s official channels for current guidance.

Key takeaways

• A deprecated, unpatchable Balancer V1 contract lost about $250,000 on September 6, 2026, after an earlier $234,000 incident on August 31.
• The attacker reportedly used over $1 billion in flash loans through three Aave V3 markets and borrowed $788 million more, all unwound within the same transactions.
• Aave reported no loss. The damage stayed with Balancer V1 liquidity providers.
• Blockaid argues balance-only monitoring misses this pattern. That claim, and the detection details, come from Blockaid itself and haven’t been independently verified.
• Chain, recovery status and attacker identity remain unconfirmed in the coverage we found.

Sources

• Blockaid: A Billion-Dollar Blind Spot, October 22, 2026
• The Crypto Times: Blockaid Warns of DeFi Monitoring Gap After Balancer Exploit
• Crypto Economy: Balancer Exploit Exposes DeFi Monitoring Gaps, Blockaid Says
• KuCoin News (via BlockTempo): Balancer V1 Pool Affected by Precision Vulnerability, Loses $234,000

Disclaimer: This article is for educational purposes and isn’t financial advice. Crypto and DeFi carry significant risk, including total loss. Do your own research (DYOR) before using any protocol.

Want more plain-English breakdowns of DeFi incidents? Browse our latest security coverage on FiscalFrontier.co and subscribe so you don’t miss the next one.