Crime & Security1 min readThe AssayerLook-back
Q4 2025 in crypto hacks: Balancer’s rounding error made up 55.4% of $231.2 million
Losses in the fourth quarter of 2025 came to $231.2 million across 37 incidents, down from $321 million in the third quarter and up from $178.3 million in the fourth quarter of 2024.
Balancer
On November 3, Balancer V2’s Composable Stable Pools lost about $128 million. An attacker abused a rounding-down error in the invariant math of its batch swap function. Each swap left a tiny discrepancy, and chaining many of them in quick succession drained pool reserves across several chains.
It was 55.4% of the quarter’s losses and ranks 33rd of the 1,272 incidents with a known loss. Balancer’s code had been running for years before the flaw was found.
Upbit
The quarter’s only exchange loss was at Upbit, South Korea’s largest exchange. Its hot wallet was emptied of about $36 million in Solana-based tokens over 54 minutes. The attacker exploited weak signing infrastructure that let private keys be worked out from on-chain transaction history.
On October 30, an attacker compromised one of Garden Finance’s solvers, the services that complete its cross-chain swaps, and drained over $10 million across Ethereum, Arbitrum, Base and Solana. The ledger records $11.4 million.
The year
Three incidents of $10 million or more made up 75.9% of the quarter’s losses. DeFi protocols lost $173.3 million across 30 incidents.
Across 2025, the ledger records 146 incidents and $2.72 billion in known losses, against 206 incidents and $1.67 billion in 2024. Fewer incidents but higher losses came down to Bybit: without its $1.40 billion, the year’s losses would have been $1.32 billion.
Sources
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
More on Bybit
