Balancer Publishes Full Post-Mortem of $121M V2 Exploit
**Balancer released comprehensive post-mortem of November 3 exploit that drained $121M from V2 Composable Stable Pools**
**Technical Root Cause:**
- Incorrect rounding in exact-out swap calculations
- Required three conditions: rounding error, rate providers, and low liquidity
- Only affected specific V2 pools with BPT tokens and rate providers
**Recovery Efforts Secured $45.7M:**
- Emergency pool pauses protected $19.3M
- Whitehat rescues recovered $4.6M across chains
- StakeWise DAO emergency operation recovered $21.8M in osETH/osGNO
**Key Response Timeline:**
- 07:46 UTC: Attack detected, whitehats immediately front-ran on Ethereum
- 08:07 UTC: V6 pools paused, protecting vulnerable liquidity
- 11:01 UTC: Recovery mode activated for safe withdrawals
**V3 Completely Unaffected:**
- Different architecture with explicit rounding controls
- Consistent 18-decimal precision
- Formal verification prevented this attack vector
**Migration Plan:**
- V2 stable pool factory disabled
- BAL incentives stopped for affected pools
- Weighted and Gyro pools remain operational
- Comprehensive V3 migration guidance coming
**Fund Recovery Process:**
- Pool-by-pool basis, not socialized losses
- Active claiming required (no airdrops)
- Governance proposal needed for distribution
- Law enforcement coordination ongoing
[Read full post-mortem](https://medium.com/balancer-protocol/nov-3-exploit-post-mortem-51dcbeb6b020)