The <button class="define-target" id="defi">defi</button> protocol Balancer suffered a major exploit that drained over $110&nbsp;million across several blockchains, including Ethereum, Polygon, Base, and Sonic. Attackers exploited faulty access control in the <code>manageUserBalance</code> function of Balancer's v2 <button class="define-target" id="smart-contract">smart contract</button>, enabling unauthorized internal withdrawals. The stolen tokens included 6,850&nbsp;osETH, 6,590&nbsp;wETH, and 4,260&nbsp;wstETH, later consolidated into new wallets likely for laundering.<p>The exploit also impacted <button class="define-target" id="fork">forked</button> protocols like Beets Finance, which lost around $3&nbsp;million. Balancer's BAL token dropped over 10% following the theft.</p><p>This was Balancer's third major security incident since 2020, despite prior <button class="define-target" id="audit">audits</button> by OpenZeppelin and Trail of Bits.</p>

"Balancer Hit by Apparent Exploit as $110M in Crypto Moves to New Wallets"

Balancer exploit #2

Balancer exploited for at least $110&nbsp;million

The Stream Finance <button class="define-target" id="defi">defi</button> <button class="define-target" id="yield-farming">yield</button> project announced that "an  external fund manager overseeing Stream funds disclosed the loss of approximately $93&nbsp;million in Stream fund assets." Stream announced that they were in the process of withdrawing remaining liquid assets, and had halted all deposits or withdrawals. They also announced they had retained a law firm to investigate the "incident".<p>The project didn't disclose who the fund manager was, or the circumstances in which the "loss" occurred.</p><p>The Staked Stream USD token <button class="define-target" id="peg">depegged</button> on November 3, and crashed further following the announcement.</p>

Stream Finance loss

Stream Finance halts activity after $93&nbsp;million loss

A holder of around 14.4&nbsp;million ADA (~$6.9&nbsp;million), the token for the Cardano network, made an expensive error when attempting to swap the tokens for a <button class="define-target" id="stablecoin">stablecoin</button>. Because the stablecoin they were looking to buy is lightly used and has only around $10.6&nbsp;million tokens in circulation, an attempt to purchase millions of the tokens on the market caused the dollar-<button class="define-target" id="peg">pegged</button> stablecoin's price to spike to around $1.26. The resulting <button class="define-target" id="slippage">slippage</button> meant that the trader spent their roughly $6.9&nbsp;million in tokens to receive a little less than $850,000 in the USDA stablecoin, meaning the trader essentially threw away $6&nbsp;million.<p>Observers have questioned what happened. It's possible that the holder, who had not been active on-chain since 2020, was simply unaware of the slippage risk. It's also possible that it was a "fat-finger" trade — that the trader accidentally selected the wrong stablecoin from a list of similarly named options, some of which could have more easily absorbed a trade of that size.</p>

"'Fat-Finger' Fail? Cardano Whale Torches $6M After Hitting Illiquid USDA Pool"

Cardano holder loses $6&nbsp;million to slippage

The Moonwell lending protocol, built on the Base Ethereum <button class="define-target" id="layer-2">L2</button>, wound up with $3.7&nbsp;million in <button class="define-target" id="bad-debt">bad debt</button> after an attacker took advantage of an <button class="define-target" id="oracle">oracle</button> malfunction that caused the price of wrsETH to be massively inflated. The Chainlink oracle used by the project erroneously reported that a single wrsETH token (Kelp DAO's <button class="define-target" id="wrapped-token">wrapped</button> <button class="define-target" id="restaking">restaked</button> ETH) was priced at around 1.65&nbsp;million ETH (~$5.8&nbsp;billion). Within 30&nbsp;seconds of the oracle reporting bad data, an attacker took advantage of the error to borrow huge amounts of tokens, which they then swapped to other tokens to cash out.<p>Ultimately the attacker profited around 295&nbsp;ETH (~$1&nbsp;million), but the protocol was saddled with significantly more bad debt that the team will now have to grapple with.</p>

Moonwell oracle malfunction

Moonwell accrues almost $3.7&nbsp;million of bad debt after oracle malfunction

An attacker stole approximately $3.1&nbsp;million from the BNB chain-based GANA Payment project. The thief laundered about $1&nbsp;million of the stolen funds through Tornado Cash shortly after. The attacker was able transfer ownership of the GANA contract to themselves, possibly after a <button class="define-target" id="private-key">private key</button> leak.<p>The theft was first observed by crypto sleuth zachxbt. Not long after, the project acknowledged on its Twitter account that "GANA's interaction contract has been targeted by an external attack, resulting in unauthorized asset theft."</p>

Event	Date	Amount More info
Balancer exploit #2	November 3, 2025	$110,000,000
Stream Finance loss	November 4, 2025	$93,000,000
Cardano holder loses $6 million to slippage	November 16, 2025	$6,000,000
Moonwell oracle malfunction	November 4, 2025	$3,680,000
GANA Payment hacked for $3.1 million	November 20, 2025	$3,100,000