Balancer DAO Starts Discussing $8M Recovery Plan After $110M Exploit Cut TVL by Two-Thirds

Weeks after suffering a major exploit that drained over $110 million from its Balancer v2 vaults, Balancer DAO has begun discussing a plan to distribute roughly $8 million in recovered assets to affected liquidity providers (LPs).

The funds were rescued by whitehat actors and internal teams shortly after the attack occurred on November 3. According to a request for comment (RFC) posted by DAO contributor Xeonus, the proposed plan includes a structured payout for whitehats, as well as a reimbursement mechanism for users based on snapshot data of their pool holdings at the time of the exploit.

These measures align with Balancer’s previously adopted Safe Harbor Agreement, which outlines rules for ethical hackers recovering funds.

The Safe Harbor framework caps bounties at $1 million per incident and requires full know-your-customer (KYC) and sanctions screening from participating whitehats. Notably, several anonymous rescuers on Arbitrum declined to identify themselves, waiving any bounty claim.

Recovered tokens span networks like Ethereum, Polygon, Base and Arbitrum, and include assets such as WETH, rETH, WPOL and MaticX. Liquidity providers will receive payments in the same tokens they originally provided, calculated on a per-pool, pro-rata basis.

A claim mechanism is being developed and will require users to accept Balancer’s updated terms of use if the DAOs move the approval to voting, and that’s approved.

While $8 million is being redistributed through the DAO, another $19.7 million in osETH and osGNO was rescued by StakeWise (a whitehat hacker) and will be handled separately. A further $4.1 million was recovered internally through coordinated efforts with another whitehat, Certora, but is ineligible for whitehat bounties due to prior service agreements.

The exploit, caused by a flaw in Balancer’s smart contract access controls, marks the protocol’s third major security incident.

Total value locked (TVL) on Balancer has plunged from around $775 million to $258 million after the exploit, while the protocol’s BAL token lost around 30% of its value.