Date: August 31, 2026
Chain: Ethereum
Loss: about $234,000 across the Balancer V1 pools hit in the incident, per SlowMist, about $111K of it from the DPI pool
Class: fixed-point rounding on a join path with no floor on what a deposit has to be worth
At 02:28:23 UTC on August 31, 2026, a Balancer V1 pool holding equal weights of DPI, USDC, ETH and WBTC started accepting one satoshi of WBTC, 0.00000001 of a bitcoin, as full payment for its pool tokens. SlowMist reported 4,408.8 pool tokens minted that way, a claim on nearly everything the pool held. That pool held about $111K by DeFiHackLabs' count, and it was one of five Balancer V1 pools drained in the same incident, which SlowMist put at about $234,000 in total.
The pool had been running since December 2020, and Balancer V1 contracts can't be paused or upgraded, so there was nothing anyone could switch off once it started. The attacker first used ordinary swaps to squeeze the pool's WBTC balance down to dust, and at that size the math that prices a single-token deposit rounded the required WBTC down to the smallest amount the contract would still accept.
Balancer pools hold two or more tokens at custom weights and issue Balancer Pool Tokens (BPT) as shares. Holding BPT entitles you to a proportional slice of every token in the pool, and redeeming it returns that slice. The pool at the center of this exploit is labeled on Etherscan as Balancer's DPI/USDC/ETH/WBTC 25/25/25/25 pool, a BPool created through Balancer's V1 factory on December 19, 2020.
On the day of the exploit, Balancer said it was aware of a bug in the legacy V1 contracts that can drain LP funds, noted that these pools are deprecated and can't be paused, and urged liquidity providers to exit them, according to The Defiant. Balancer Labs had announced in March 2026 that it would wind down as a company and hand operations to the DAO, months after attackers drained about $116 million from Balancer V2 pools in November 2025 through a bug in the same family, according to Bitcoin.com News.
Most deposits name an amount of tokens and ask how many pool tokens come back. Balancer V1's joinswapPoolAmountOut works the other way around: the caller names the number of BPT they want, and the contract calls calcSingleInGivenPoolOut to work out how much of a single token they owe. That reverse calculation runs in 18-decimal fixed-point arithmetic, and WBTC only has 8 decimals.
While the pool holds a healthy amount of WBTC, the rounding is invisible. Once the WBTC balance is compressed toward zero, the calculation rounds down, and the required input can land on 1 satoshi. Balancer V1 rejected deposits that came out to zero, but 1 satoshi isn't zero, so the join went through and minted every BPT requested.
SlowMist's alert names three guards the join path didn't have: a minimum effective input, a minimum pool balance and a relative-error check. The contract's MIN_BALANCE check only ran in bind and rebind, when tokens are added to a pool, and never during ordinary swaps, so nothing stopped swaps from pushing a reserve into the range where the rounding breaks.
Rounding is safe only when the error is tiny compared with what's being paid for. A store that rounds every price down to the nearest cent loses nothing on a $40 item, but if a single item can be priced at a fraction of a cent, rounding hands it over for free. Every path that mints shares needs a floor on what the deposit is worth relative to the shares it buys. Blockfence points to a balancer-core GitHub issue, number 204, opened in January 2020, that described a similar high-severity rounding problem.
SlowMist describes the sequence. The attacker took nested flash loans, borrowed and repaid within the same transaction, from Spark or Aave, Morpho and Uniswap V3, and used the borrowed funds for public swaps that pushed the pool's WBTC reserve down to dust. Those swaps paid fees like any other trade. The DeFiHackLabs reproduction pins the drain of the DPI pool to one transaction in block 25872274, sent from the attacker's wallet to an unverified attack contract, and shows the swaps taking the WBTC reserve down to about 2 satoshi.
With WBTC at dust, joinswapPoolAmountOut started pricing deposits at 1 satoshi. In the reproduction, the attack contract loops joinswapPoolAmountOut against exitswapPoolAmountIn, paying 1 satoshi of WBTC each time, until it holds nearly the whole BPT supply, then calls exitPool to redeem it for the pool's DPI, USDC, WETH and WBTC and repays the loans. DeFiHackLabs puts the DPI pool's holdings at about $110,839 before the attack, in four balanced legs of about $27.7K each. On Etherscan today the pool holds a few dollars' worth of each token, about 1.18 USDC, 0.00047 WETH, 0.000015 WBTC and 0.0205 DPI.
The attacker's wallet first received ETH through RAILGUN's Relay Adapt contract, a privacy protocol, on August 29. Seventy-two seconds after the drain, at 02:29:35 UTC, a Sweep call on the attack contract sent out 11.44 ETH. The wallet kept going for hours afterward. It took 0.5 ETH at 03:34 UTC, sent Execute calls to a second contract at 0x0359...3450, including one at 03:37:23 UTC that shows about 53,834 WETH from Spark and 12,166 WETH from Morpho arriving alongside swaps that shrank the WBTC side of Balancer's WBTC/ETH 50/50 #5 pool to 0.00000001 WBTC, then deployed a third contract at 03:41 UTC and sent it fourteen more Execute calls between 06:15 and 06:29 UTC.
On September 3, a zero-value transaction landed in the attacker's wallet carrying an on-chain message. It came from 0x3877...2270, an address that Etherscan shows was funded by the account labeled Balancer: Deployer 4 and that deployed a Balancer V3 Vault Factory in December 2024. Seven minutes later, the same address sent a second zero-value transaction to another wallet, 0x67DE...6c17. According to Crypto Times, Balancer asked the operator to return the funds to the Balancer DAO multisig in exchange for a bounty, to make contact through Blockscan before September 8 at 21:00 UTC, and named SEAL911, Hypernative and its legal team as parties to the process. Balancer said it wouldn't pursue legal action against a wallet owner who returned the funds, and that without a response, any bounty would go to informants who help identify the attacker. No public report since then mentions funds being returned.
SlowMist also flagged that Balancer V1's join and exit math has been copied into many forks, and any fork that kept calcSingleInGivenPoolOut without a minimum-input or minimum-balance guard carries the same exposure.
Olympix reads a pool the way an attacker does, as states, transitions and entry points, and takes in the context around it, here a weighted pool whose tokens have different decimals. The state that matters is each token's reserve and the total BPT supply, and the paths worth mapping are the ones that change them. The engine uses signals to choose which paths to attack, and Olympix's static analysis surfaces the one in this pool: a mint path whose required input comes from a rounded-down fixed-point division, guarded only against a zero result, with no floor on input value and no minimum balance enforced on the swaps that set the reserve.
That signal only says a rounding edge exists. Whether it costs anyone money depends on the pool's state, and that's the question BugPoCer answers by looking at the pool as a whole. The rule it infers is that minting BPT must cost at least the pro-rata value of the shares minted, so a join can never leave existing holders worse off. Using Counterexample-Guided Invariant Refutation, it searches outward from that rule through sequences of swaps, joins and exits, and the sequence that breaks it here drives a reserve to dust with swaps and then mints shares against a rounded input.
The counterexample is the exploit itself in miniature: the swaps that compress the WBTC reserve, the joinswapPoolAmountOut calls that mint BPT for 1 satoshi each, and the exit, with the minimal reserve conditions that make the rounding fail and a generated Forge test that replays it. Olympix has flagged this class before in other codebases, and the counterexample turns a rounding edge case into a concrete number a developer can see.
Olympix runs automatically in development, at every merge and before release, which matters most for code that gets forked. A team that copies Balancer V1's math into a new pool gets the same check on its copy before it holds any deposits.
Rounding errors look harmless at normal sizes, and the pools that lose money to them are the ones where an attacker can make the sizes abnormal first. Any contract that mints shares from a computed input should check that the input is worth what it buys and keep reserves above the point where its math stops being accurate. If your protocol forks or extends AMM math, book a technical walkthrough.
Protocol: Balancer V1 (BPool, DPI/USDC/ETH/WBTC 25/25/25/25)
Chain: Ethereum
Date: August 31, 2026, 02:28:23 UTC
Loss: about $234,000 across the incident's Balancer V1 pools per SlowMist; about $110,839 of it from the DPI pool per DeFiHackLabs
Attacker wallet: 0x338C...9a41
Attack contract (DPI pool drain): 0x9cAa...1be3
Vulnerable BPool (DPI/USDC/ETH/WBTC): 0x2257...aC57
DPI pool drain tx: 0x7251...1aff
Block: 25872274
Sweep tx (11.44 ETH out): 0xabf2...f55b
Second contract called by the attacker: 0x0359...3450
Third contract deployed by the attacker: 0xed1A...975e
Attacker tx with Spark and Morpho WETH (WBTC/ETH pool): 0xaf19...4523
On-chain notice tx (Sept 3): 0xd485...cd4f
SlowMist: Balancer V1 exploit alert
DeFiHackLabs: Balancer V1 BPool exploit PoC
Blockfence: Balancer V1 Pool Exploited for $234K Through Rounding Bug
The Defiant: Balancer Warns Legacy V1 LPs to Exit After Pool-Draining Bug
Bitcoin.com News: Balancer V1 Pool Hacked for $234K in Same Bug Family
Crypto Times: Balancer Sends Onchain Notice to Wallet Linked to V1 Exploit