Balancer V1 Legacy Pools: A Rounding Error Costs $234,000, and Nobody Can Pause the Pools

If you have liquidity sitting in an old Balancer V1 pool, you have to withdraw it yourself. Nobody can pause those pools for you. On August 31, 2026 Balancer called on liquidity providers to exit the retired V1 pools, after an attacker had drawn roughly $234,000 out of one of them through a rounding error. The contracts date from 2020, they cannot be paused, and the company that once built them has not existed since spring 2026. The exit therefore rests entirely with you.

We measured the situation ourselves on the Ethereum blockchain on September 1, 2026, rather than assembling it from reports. What came out of that is set out further down: the affected pool is effectively empty, the function that was attacked is still sitting in the contract, and the factory that produces such pools is running unchanged.

What happened in the Balancer V1 pool on August 31: $234,000 through a rounding error

On August 31, 2026 a liquidity pool built to the Balancer V1 design lost around $234,000, according to an analysis by the security firm SlowMist. The pool held four assets, among them Wrapped Bitcoin (WBTC), the form of Bitcoin represented on Ethereum. The attacker needed no stolen keys and no back door. He used nothing but the contract's public functions, exactly as any other user would.

Balancer confirmed the same day that the old V1 contracts contain a flaw through which liquidity providers' balances can be drained, and pointed those affected to the legacy exit interface. Its other products, it said, are not affected. The addition that matters came from Balancer itself: the retired pools are non-pausable. There is no switch that would stop trading inside them.

Measured against other incidents this year, the scale of the loss is small. Its significance lies elsewhere. The flaw belongs to the same family as the attack on Balancer V2 in November 2025, in which between $110 million and $128 million flowed out depending on the source. The same arithmetic logic, the same kind of imprecision, nine months later and in contracts nobody looks after any more.

Rounding error, BPT and joinswapPoolAmountOut: the terms behind the attack

Three terms have to be understood, or the episode stays opaque.

What a liquidity pool is

A liquidity pool is a contract on the blockchain into which several users deposit balances so that others can swap between those assets for a fee. Whoever deposits receives pool shares in return. At Balancer these shares are called Balancer Pool Tokens, or BPT for short. A BPT is therefore nothing other than the receipt for your share of what is in the pot.

What a rounding error means in this context

Blockchains do not calculate with decimal fractions but with whole numbers and a fixed number of decimal places. Balancer V1 works internally with 18 decimal places. WBTC, though, has only 8, and USDC only 6. Where those precisions meet, the contract has to round. A rounding error is the gap that opens up when the rounding always falls in the same direction and nobody checks whether the result still makes sense.

What the joinswapPoolAmountOut function does

This function reverses the usual sequence. Normally you state how much you are depositing and the contract works out how many pool shares you get for it. With joinswapPoolAmountOut you state how many shares you want, and the contract works backwards to how much you have to deposit for them. That backwards calculation was the point of attack.

4,408.8 pool tokens for one satoshi: how the attack worked arithmetically

The sequence can be set out in three steps, and it is alarmingly banal. First the attacker shrank the pool's WBTC holding through a series of entirely ordinary swaps, until almost nothing was left of it. Squeezing that reserve is the actual trick, because the contract's backwards calculation depends on the balance in hand.

In the second step he requested a large quantity of pool shares through the function described above. Because the reserve was effectively at zero, the calculation rounded the required stake down to a single satoshi, the smallest representable fraction of a Bitcoin, worth a tiny fraction of a cent. The contract minted the full quantity requested regardless: 4,408.8 shares, according to SlowMist's analysis.

In the third step he redeemed those shares again and was paid out his proportion of the pool's entire contents. He had paid one satoshi for it. SlowMist describes the core of the problem plainly: the pool lacked basic safeguards, among them a minimum input, a minimum balance and a check on the relative error.

Non-pausable: why nobody can stop the Balancer V1 legacy pools

In modern DeFi protocols an emergency stop is standard equipment. When a flaw comes to light, the team or a multi-signature address freezes the affected contracts and users gain time. Balancer V1 comes from a period when that was not yet a given. The contracts have no such switch.

From that follows an unfamiliar distribution of roles. In a normal incident the protocol protects you and you wait. Here there is nobody doing the protecting. The contracts keep running, the vulnerable function stays callable, and the only action that moves your stake out of the danger zone is your own withdrawal. That is why Balancer's call to action is so unusually direct.

Our measurement on September 1: what is still sitting in the exploited pool

So that you do not have to rely on second-hand accounts, we read out the affected contract ourselves. This survey was carried out by cryptoticker.io on September 1, 2026.

How we measured

We queried the pool contract at address 0x2257aa…ac57 directly through a public Ethereum endpoint, along with the associated Balancer V1 factory and the address SlowMist names as the attacker. Three contracts and addresses were examined with fourteen individual queries in total, all on September 1, 2026 between 18:52 and 18:55 UTC, each at block 25,884,349.

The findings in detail. The pool holds four assets: USDC, Wrapped Ethereum (WETH), WBTC and the index token DPI. What is left of them is 1.185195 USDC, 0.00047920 WETH, 0.0000149 WBTC and 0.02062253 DPI. That is not a residual holding, that is dust. The total supply of issued pool shares stands at 6.0763871974 BPT, and the swap fee at 0.5 percent.

Two status flags on the contract are instructive. The pool is finalised, so its composition can no longer be changed. And it remains open for public swaps. It has been emptied, but it has not been taken out of circulation. The factory confirms on request that this is a genuine pool from its own production.

The most important point concerns the program code itself. The pool's code as stored on the blockchain is 22,537 bytes in size, and the identifier of the attacked function sits unchanged within it. Contracts on Ethereum cannot be altered after the fact. What has once been published stays in that form for as long as the chain runs.

The Balancer V1 factory is still running: new legacy pools can be created to this day

The second part of the measurement was the surprising one. The factory from which all Balancer V1 pools originate sits at address 0x9424B1…76Bd on Ethereum. It is still in place, its code runs to 24,407 bytes, and that code contains the identifier of the same function through which the attack ran. That is logical enough, because such a factory carries the blueprint for its pools inside it and passes it on at every new creation.

In practice that means: anyone who wants to create a new Balancer V1 pool today can do so, and they will get a pool with the same arithmetic logic. We did not create a pool to prove it, which would have been an intervention and not a measurement. The statement rests on the blueprint in the factory's code.

For you as a reader that is less a warning about Balancer than a warning about a property of this technology: old code does not disappear. It merely becomes unsupervised.

Are you affected? How to spot a Balancer V1 position in your wallet

Most retail investors are untouched by this incident. Anyone who holds crypto assets at an exchange or in a hardware wallet and has never provided liquidity has nothing to do with V1 pools. You are affected only if one of the following descriptions fits you.

• You deposited balances into a Balancer pool between 2020 and 2022 and never retrieved that stake.
• Your wallet holds a token whose name suggests a pool and whose price is nowhere displayed cleanly.
• You deposited back then through another provider's interface that used Balancer V1 contracts in the background.
• You manage a wallet for somebody who was active in that period, following an inheritance for instance.

The quickest test takes a few minutes: open a blockchain explorer, enter your wallet address and look through the list of your tokens. Pool shares appear there as a token in their own right. If you find such an entry, check through Balancer's legacy exit interface whether a V1 pool sits behind it.

Forks of the V1 code: why the rounding error does not stop at Balancer

Balancer V1 is open source. Over the years numerous projects have copied that code and adapted it for their own purposes. That is common in this industry and was long a mark of quality: audited code you do not have to write from scratch.

The drawback is showing now. The arithmetic logic for entry and exit runs today in programs that have nothing left to do with Balancer, and whose operators will not even hear of the August 31 notice. The Crypto Times points to exactly that in its account of the incident and refers to a case from June 2026 in which attackers exploited comparable weaknesses in rebuilt pools of the Ocean Protocol on the Polygon chain.

For you the consequence is an uncomfortable rule of thumb: it is not enough to check whether you were ever exposed to Balancer itself. If you have at some point provided liquidity to a pool whose operator has published nothing for years, the same consideration applies.

Exiting proportionally: what withdrawing from a legacy pool means in practice

Balancer points those affected to a proportional exit through the legacy interface. Proportional means: you get back the fraction of each asset in the pool that corresponds to your share, rather than the whole sum in a single asset.

That sounds like a detail but it is the decisive difference. The single-sided exit, where you withdraw everything in one asset, runs through the very arithmetic logic that made the attack possible. The proportional exit does not touch that calculation. It simply divides up.

Three points are worth keeping in view. First the network fee: with a very small residual holding it can exceed the value of your position, in which case the withdrawal makes no economic sense. Second the interface: call up the exit page exclusively through the provider's official channels, because incidents like this one are an occasion for fraudsters to promote fake sites with similar addresses. Third the order of operations: first establish which contract sits behind your position, and sign afterwards.

From the V2 hack in November 2025 to the wind-down of Balancer Labs: who is responsible today

The back story explains why the response is so terse. On November 3, 2025 between $110 million and $128 million, depending on the source, flowed out of Balancer V2 pools across several blockchains, likewise through an imprecision in the arithmetic logic.

On March 24, 2026 co-founder Fernando Martinelli announced in a governance forum post that Balancer Labs would be wound up as a company. His reasoning: the company carries the legal consequences of past security incidents, while the protocol has to carry on unencumbered. The protocol itself has since run on in a lean, community-managed form. According to reports at the time, the total value locked in the protocol fell from over $750 million to around $150 million.

That answers the question of responsibility, and the answer is unsatisfying. For contracts dating from 2020 there is no team left that could intervene, and a switch to halt them never existed there in the first place.

What we could not measure, and why that matters to you

Three questions had to remain open, and we name them rather than paper over them.

First, it remains open how many Balancer V1 pools exist in total and how much money still sits in them today. The query of the event logs across the entire chain history that this would require was refused by all four of the free Ethereum endpoints we tested. That figure would have been the real measure of the size of the problem.

Second, the state of the pool before the attack could not be read out, because that requires archive access. We can therefore confirm that the pool is empty today, but cannot recalculate for ourselves what was in it beforehand. For the loss figure we rely on SlowMist's analysis and the reports built on it.

Third, we have not determined which other projects adopted the V1 code. Doing so would mean comparing the program code of thousands of contracts. The reference to the rebuilds comes from the reporting, not from our measurement.

A note on the address SlowMist names as the attacker: it is an ordinary user account with no program code stored against it, has triggered forty transactions, and currently holds around 0.000031 Ether and none of the four pool assets. The proceeds are therefore no longer sitting there. Who this address belongs to cannot be established from the outside, and we assert nothing on that point.

Checking Balancer V1 legacy pools: what to take away

1. Look in your wallet before you read any further. Open a blockchain explorer with your address and search for tokens that look like pool shares. If you find nothing, you are done. Where to keep your holdings safely afterwards is shown in our comparison of hardware wallets.
2. Withdraw any position you find proportionally. Use the official exit interface and the proportional route, not the single-sided one. If you want to keep earning a return afterwards without standing in unsupervised contracts, the staking platforms compared give you an overview of the supported alternatives.
3. Note the date, amounts and fees of the withdrawal. Exiting a liquidity pool is an event you should document cleanly for your tax records; the assessment in an individual case belongs in the hands of a tax adviser. Which wallet software lists the transactions clearly for you is set out in our comparison of software wallets.

The lasting sentence from this incident is unspectacular and nonetheless the most important: a contract nobody maintains any more does not become harmless when it falls into obscurity. It merely becomes quiet.

Sources: the account of the incident at The Crypto Times, and the legacy exit interface of Balancer, through which the proportional withdrawal runs.

(As of September 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)