Balancer: The DeFi Pioneer That Held $3.3B Votes 99% to Shut Down

At seven in the evening, London time, on 29 September 2026, a vote closed that ended one of the oldest names in decentralised finance. Balancer, a crypto trading service that at its peak held $3.3 billion of other people's money, had asked its owners whether it should shut itself down. More than 99% of the votes said yes.

Balancer is not a company in the ordinary sense. It is a set of programs running on Ethereum and other blockchains (shared public ledgers that anyone can inspect), steered by the holders of a token called BAL. Owning BAL works much like owning voting shares: holders put forward proposals and vote on them, one vote per token. The shutdown plan, numbered BIP-928, drew about 17.2 million BAL. A rival plan to hand the project to a new team, BIP-929, was rejected with about 70% against.

The money had left long before the vote. DefiLlama, a public service that tracks the sector, puts Balancer's deposits at a peak of $3.31 billion on 5 November 2021. On 3 November 2025, the day it was hacked, it still held about $776 million. Two days later the figure was about $304 million. By the vote it was about $58 million. What is left in the treasury, about $9.96 million, will be shared among BAL holders from the end of May 2027. At September prices that works out to about 16 cents a token. BAL traded above $74 in May 2021.

©CMZ chart. Data: DefiLlama

What Balancer was

Picture a vending machine that always quotes a price. Most stock exchanges match a buyer with a seller. Balancer did not need a seller. Each "pool" was a pot of two or more tokens held by a program, and a fixed formula set the price from how much of each token the pot contained. Buy one token out of the pot and it becomes scarcer, so the formula charges more for the next one.

Somebody has to stock the machine. These liquidity providers deposit tokens into a pool and take a slice of every trading fee, much as an investor in a fund takes a share of its income. They get a receipt token, a BPT, which works like a fund unit and can be cashed in for a share of the pot.

Balancer's twist was that its pools could hold several tokens at chosen weightings, 80/20 for example, so a pool behaved like a self-rebalancing index fund that earned fees instead of paying them. Fernando Martinelli and Mike McDonald started the project, which went live in 2020. From 1 June 2020 it paid BAL to anyone who supplied deposits, a reward scheme that helped set off the "DeFi summer" frenzy of that year.

The $128 million rounding error

At 07:46 UTC on 3 November 2025 the security firm Hypernative flagged strange trading in Balancer pools. Within about half an hour roughly $128 million had gone, across Ethereum, Arbitrum, Base, Polygon, Berachain and several other networks. The pools hit were an older design called v2 Composable Stable Pools, mostly holding tokens that represent staked Ether, such as osETH, wstETH and rsETH. The newer v3 system was not affected.

Nobody stole a password. The attacker used arithmetic. In plain steps:

First, the attacker drained a pool until one of its token balances was down to a handful of the smallest possible units, eight or nine of them.

Second, Balancer's code converts every balance to a common scale before doing its sums, and it rounds down. On a normal balance the rounding is worth a fraction of a penny. On a balance of eight units, losing one unit is a 12.5% error, according to a breakdown by Check Point Research.

Third, the attacker packed more than 65 tiny swaps into a single transaction. Each one rounded the same way, and the errors stacked up. The pool's own estimate of what it held fell, and so did the price of its receipt tokens.

Fourth, the attacker cashed in those underpriced receipts for real tokens, then repeated the trick pool after pool and chain after chain.

The code had been reviewed by several audit firms, including Trail of Bits and Certora. Above the rounding function sat a developer's comment, quoted by the investigations site Rekt: "The impact of this rounding is expected to be minimal."

Some money came back. StakeWise, which issues osETH, used a control in its own contracts to claw back about $20 million. Berachain halted its whole network and pushed through an emergency software change, a hard fork, to recover about $12.8 million. White-hat hackers (people who seize funds in order to return them) rescued about $3.86 million and were paid a 10% reward. On 28 November 2025 Balancer set out a plan to return about $8 million to depositors in the affected pools. The attacker has not been identified and no charges have been reported. The shutdown plan says private investigators and law enforcement are still working the case.

The plan that did not work

Balancer Labs, the company that built the protocol, announced its own closure on 24 March 2026, leaving a smaller team answering to token holders. In April holders approved a rescue: no more BAL rewards, all trading fees routed to the treasury, the team cut from about 25 people to the equivalent of 12.5 full-time staff, and a bet on the newer v3 system.

Marcus Hardt, who led Balancer Labs as chief executive, explained what happened next in a post on X on 14 September, the day he proposed the shutdown. "On the cost side, the plan was executed. Revenue is where it went wrong." He added: "The product worked. It did not sell enough." And: "I underestimated how much the exploit would continue to limit adoption."

The figures back him. DefiLlama puts Balancer's monthly revenue at $1.13 million in October 2025 and $56,781 in August 2026. Hardt's proposal, on a narrower measure, put August at about $30,000, against costs of about $150,000 a month. "I do not see a funded path that changes this picture," he wrote. Martinelli, the co-founder, backed the plan on the forum, writing that the team "just could not overcome the burden" of the hack.

The fork that lost

Not everyone wanted a funeral. Two long-standing contributors, known online as Gosuto and Zekraken and trading as MAXYZ, proposed BIP-929, an "official fork": a copy of the code relaunched by a new team. They asked for about 6 million BAL that was not in circulation, worth roughly $690,000, and wanted the pools kept open until mid-2027. About 5.2 million BAL voted yes and about 12.1 million voted no.

Very few hands decided it. Snapshot, the voting site Balancer uses, records 42 wallets voting on BIP-928 and 51 on BIP-929. About 70 million BAL is in circulation, so roughly a quarter of it took part.

What users have to do, and by when

Anyone with money in a Balancer pool should take it out. On 30 October 2026 every pool that can be paused switches to withdrawals only: deposits and trades stop, cashing out still works. The same day the bug bounty ends, so nobody is paid to report flaws any more. Pools that cannot be paused keep running with no protocol fee. A few v3 pools kept open at partners' request close on 30 November.

Withdrawing does not depend on Balancer staying in business. The pool programs let any depositor take their share back directly, and a basic withdrawal page stays online until the payouts finish.

BAL holders get nothing before the end of May 2027. Then a six-month window opens, closing at the end of November 2027. A holder hands in BAL, which is destroyed, and receives a share of the treasury in kind, about six different tokens rather than cash. Missing it means missing the later payouts in January and July 2028. BAL that is locked up, known as veBAL, will have unlocked by then. Holders of wrapped versions such as auraBAL and sdBAL must convert back to plain BAL first.

Money recovered from the hack sits outside all of this and goes only to the depositors who were robbed.

On 1 October BAL traded at about 13 cents, below the 15.79-cent estimate. The gap is the price of waiting eight months for a basket of tokens whose value can still move.