Balancer warns liquidity providers to exit V1 pools after $234,000 drain from rounding bug

Balancer warns liquidity providers to withdraw from legacy V1 pools following a critical bug that allows funds to be drained. Because these deprecated pools are non-pausable, manual user withdrawal is the only defense. Blockchain security firm SlowMist reports that an attacker already exploited a fixed-point rounding flaw in the contract's joinswapPoolAmountOut path, draining approximately $234,000 in DPI, USDC, WETH, and WBTC from one pool.

Balancer V1 pool vulnerability

• ▪Balancer warned liquidity providers on August 31, 2026, to withdraw from its legacy V1 pools due to a bug that allows liquidity provider funds to be drained.
• ▪Balancer stated that its other products are not affected by the legacy V1 pool vulnerability.

Fixed-point rounding exploit

• ▪SlowMist explained that the attacker compressed the Balancer V1 pool's WBTC reserve to dust, causing the contract to round the required input down to one satoshi of WBTC while still minting the requested pool tokens.
• ▪Blockchain security firm SlowMist attributed a Balancer V1 pool drain to a fixed-point rounding flaw in the `joinswapPoolAmountOut` path of the contract.

234,000 dollar drain

• ▪Blockchain security firm SlowMist estimated that one Balancer V1 pool lost approximately $234,000 due to the rounding exploit.
• ▪SlowMist reported that the attacker used minted pool tokens to exit proportionally and drain DPI, USDC, WETH, and WBTC from the affected Balancer V1 pool.

Liquidity provider withdrawal instructions

• ▪Balancer directed liquidity providers to exit positions proportionally through its legacy withdrawal interface, which requires users to connect a wallet, enter an address, or manually add a pool address.
• ▪Balancer's exit-interface documentation states that the tool supports proportional exits from V1 core and smart pools by scanning positions against a bundled pool list.

Non-pausable deprecated pools

• ▪Balancer's warning did not state how much value remained in the affected V1 pools or publish the addresses of the vulnerable pools.
• ▪Balancer stated that the deprecated V1 pools are non-pausable, leaving manual user withdrawals as the immediate line of defense against the pool-draining bug.

1 source