Balancer

Balancer is an automated market maker, a set of smart contracts where traders swap against pools of tokens. Its original idea, launched with v1 in 2020, was a pool that could hold more than two tokens in custom weights instead of the fixed 50/50 split of a classic pool. Later versions added stable pools for assets that should trade near the same price, boosted pools built around yield-bearing tokens, and in v3 "hooks" that let developers add custom logic to a pool.

The protocol is governed by holders of the BAL token through the Balancer DAO. Its terms of use, last updated in November 2025, say Balancer is a foundation company organised in the Cayman Islands, the Balancer Foundation, with an operating company in the British Virgin Islands, Balancer OpCo Limited. Disputes go to arbitration in the Cayman Islands.

In September 2026 the DAO voted for BIP-928, an orderly winddown. The proposal says that a restructuring approved in April 2026 cut costs, ended token emissions and routed revenue to the DAO, but v3 revenue never grew enough to replace v2. It also says the November 2025 exploit "followed the name into every conversation" and made the task harder.

The winddown changes nothing about who holds your funds: the pools are non-custodial, so your share is still yours and can be withdrawn from the contracts. What changes is what the pools do and how much support stays around them. The key dates set by BIP-928 and BIP-936, the on-chain specification:

Pools that cannot be paused keep trading after 30 October, with the protocol fee set to zero where the contracts allow it. Where a pool's contracts require it, recovery mode is switched on when it is paused, so a proportional withdrawal stays possible. Balancer says it will publish how each pool is treated before 30 October.

For most people the simplest route is the legacy interface at legacy.balancer.fi, which a Balancer contributor said on 23 October 2026 will stay available to withdraw from v1, v2 and v3 pools and to unstake gauge positions. The main app's portfolio page also checks some legacy positions and rewards.

If no interface is available, Balancer's GitHub has a manual exit guide covering every protocol version and gauge withdrawals. It explains how to find a position, verify the contract and simulate the transaction before sending it. A withdrawal from a paused pool or one in recovery mode returns your share of each token in proportion, not a single token of your choice.

Positions are easy to miss. The same forum post says more than $500,000 had been found in places dashboards do not show, including v3 liquidity buffers that use internal Vault accounting and unclaimed rewards in old v2 liquidity mining contracts. After withdrawing, it is worth revoking token approvals given to Balancer contracts you no longer use.

Swap fees on Balancer are set per pool, so there is no single rate. Part of that fee has gone to the protocol: a protocol swap fee and a yield fee on interest-bearing tokens in v2, and in v3 a fee that pool creators can share in. Under BIP-936, the v2 protocol swap and yield fee defaults go to zero on 30 October 2026 for pools that still trade. DefiLlama counts about $163,000 in fees over the past 30 days, against about $169 million of volume.

Withdrawing costs the network's gas fee; the winddown proposals do not mention any exit fee.

On 3 November 2025, starting at 07:46 UTC, an attacker drained v2 Composable Stable Pools on Ethereum, Arbitrum, Base, Optimism and Polygon. Balancer's post-mortem traces it to rounding in the "exact out" swap path. When a pool was pushed to a very low balance and run through long batches of carefully sized swaps, a tiny rounding error became a large loss. Weighted pools, Gyro pools, other stable pools and all of v3 were not affected.

Balancer's figures are not fully consistent. The post-mortem's opening estimates $94.8 million of theft, while its financial section gives $121.1 million in total losses. It counts about $45.7 million as protected or recovered. That covers $19.3 million in pools paused within minutes, about $4.6 million taken back by whitehat rescuers and about $21.8 million recovered by the StakeWise DAO in its own tokens.

Recovered funds were not pooled across everyone. Under BIP-892 they went back in kind to LPs of the specific pools affected, through a claim contract, with 10% bounties to whitehats. In July 2026 BIP-923 extended the claim window to 12 months in total, with about $920,000 still unclaimed at the time. Most of what was stolen was not recovered.

Balancer is now a protocol in the process of switching off, and it should be treated that way. The main risks:

• Legacy code: v1 pools are immutable and cannot be paused, and an exploit in August 2026 drained $1.39 million from them.
• Shrinking support: bug bounty coverage ends on 30 October 2026, and from November a small team works by the hour.
• Phishing: fake "Balancer withdrawal" or "BAL redemption" sites are a predictable risk during a shutdown; use links from balancer.fi or its forum only.
• Pools that keep running: unpausable pools may still trade with no one monitoring their prices.
• Treasury claims: the BAL redemption contract will not exist until 2027, and its specification is due by February 2027.

The protocol's audits, listed on its site, did not prevent the 2025 and 2026 losses. For a direct alternative for stable or weighted liquidity, see Curve or Uniswap, and how Balancer compares with other decentralized exchanges.

BAL is Balancer's governance token, and veBAL is BAL locked for voting power. Under BIP-928 the DAO treasury, at least $9 million at the prices in September 2026 according to the treasury manager kpk, goes to BAL holders in kind and pro rata. In the first round, from the end of May 2027, holders burn BAL to receive their share. A second round airdrops unspent budget and unredeemed shares to the first-round redeemers within two months, and a final sweep comes six months later. BAL itself and assets that resolve into BAL are excluded from the pot. Instructions for releasing veBAL locks stay published until the locks expire.

Milestones come from Balancer's post-mortem, forum and DefiLlama.

• 2020: Balancer v1 deployed.
• September 2023: front-end compromise, about $238,000 lost (DefiLlama).
• December 2024: Balancer v3 launched.
• 3 November 2025: v2 Composable Stable Pool exploit.
• April 2026: restructuring plan approved; veBAL compensation paid in May under BIP-920.
• 31 August 2026: legacy v1 pool exploit.
• September 2026: BIP-928 winddown approved.
• 30 October 2026: pausable pools move to withdrawals only.