Less than a month after the massive market crash of October 1011, the decentralized finance (DeFi) protocol Balancer V2 suffered a severe hacking attack in early November. The hackers exploited a rounding error vulnerability in the protocol's composable stable pools, accumulating losses through numerous small swaps. Within just 30 minutes, they withdrew funds from pools on Ethereum, the mainnet, and multiple chains including Arbitrum, Base, Polygon, Optimism, Avalanche, and Gnosis Chain, resulting in a total loss of $128 million. This is one of the largest attacks in the DeFi space in 2025, primarily affecting staked tokens such as wstETH, osETH, and WETH.
Following the attack, some of the funds were recovered or frozen through white-hat hacking and on-chain emergency measures. Gnosis Chain, through a validator-approved soft fork, successfully froze approximately $9.4 million of funds belonging to the hacker's address, preventing further transfer.
Gnosis Chain announces hard fork
In order to return the frozen funds to the victims, the Gnosis Chain community proposed a governance proposal on December 12, 2025, which was discussed and voted on to implement a hard fork.
The hard fork was activated around 16:00 UTC on December 22nd. Node operators need to update to the specified client version. Nodes that do not follow the majority of staking chains will face penalties, including suspension of staking rewards or even slashing. In response, on December 23rd, 2025, the official Gnosis Chain X account also released an announcement stating:
"Yesterday, our operator community decided to execute a hard fork to recover funds lost in the Balancer hack. These funds are now out of the hackers' control. All node operators who have not yet taken action should do so as soon as possible to avoid penalties."
