Threat video1:00
Balancer V2 Rounding Exploit: Detection & IOCs
A unidirectional rounding flaw let attackers drain Balancer v2 pools of $120M+. Its 19 IOCs and 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for Balancer V2 Rounding Exploit: Detection & IOCs →
Chapters
- 0:00The hookAbout $120M+ drained from Balancer pools
- 0:04The storyFour-year-old code flaw met batch swaps in November
- 0:10Attack pathAccording to analysis, identified mulDown rounding, built exploit via batchSwap
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise18 indicators to hunt: 10 URLs and 8 hashes.
- 0:39MITRE ATT&CK techniques5 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Pause affected Balancer v2 pools and activate recovery mode where.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About $120M+ drained from Balancer pools
0:05Four-year-old code flaw met batch swaps in November
0:08Pools drained in minutes
0:11According to analysis, identified mulDown rounding, built exploit via batchSwap
0:16Micro-swaps in tiny amounts trigger rounding loss, suppress BPT price
0:22Withdraw funds, replayed across Arbitrum, Base, Optimism, and more chains
0:29No threat actor is attributed. Confidence: low.
0:3418 indicators to hunt: 10 URLs and 8 hashes.
0:395 ATT&CK techniques, from resource development to impact.
0:444 steps now: Pause affected Balancer v2 pools and activate recovery mode where.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.