Balancer Proposes $8M Reimbursement Plan Following $128M Exploit

Highlights:

• Balancer proposes an $8M reimbursement plan for affected liquidity providers.
• The $8M will be repaid in kind to users from recovered assets.
• White-hat hackers get 10% bounties for successful rescue operations.

Decentralized finance (DeFi) protocol Balancer has proposed a compensation plan following a massive exploit earlier this month. The attack drained more than $128 million from Balancer’s vaults. In response, the team published a reimbursement plan on November 27 to compensate affected liquidity providers (LPs) with approximately $8 million in recovered assets.

The funds recovered are a combination of white-hat interventions and internal rescue teams from Balancer. A total of six white hat actors recovered approximately $3.86 million. Furthermore, internal teams obtained additional funds by collaborating with auditors and network partners. The combined efforts resulted in the development of a structured repayment strategy.

The platform validated a non-socialized distribution scheme for the repayments. The LPs of each affected pool will receive funds only out of that particular pool. The distributions will be pro rata according to Balancer Pool Token (BPT) holdings at the moment of exploit.

A new discussion is now live on the Balancer Forum for feedback, outlining a suggested framework for redistributing assets recovered during the recent attacks on v2, including both whitehat rescues and internal recovery efforts.

It proposes a method for reimbursing LPs in pools… pic.twitter.com/isTfmuTs4V

— Balancer (@Balancer) November 27, 2025

White Hat Bounties and Recovery Breakdown

As part of the plan, white-hat responders receive 10% bounties for their rescue efforts. The largest contributor, labeled “Anon #1,” returned $2.68 million on Polygon. Bitfinding, another actor, recovered $963,832 on the Ethereum mainnet. Other white hats recovered funds on Arbitrum and Base.

These bounties will be distributed in the form of those tokens they secured. However, white hats need to undergo identity checks to receive payments. They also need to undergo know-your-client (KYC) and sanctions checks. The unidentified ones, particularly those in Arbitrum, have rejected their bounties. The amount of funds saved by StakeWise does not form part of the $8 million distribution. StakeWise recovered $19.7 million in osETH and osGNO. They are managing separate reimbursements with their user-affected protocols in their pools.

Just half an hour earlier, StakeWise DAO emergency multisig has executed a series of transactions, recovering ~5,041 osETH (~$19M) and 13,495 osGNO (~$1.7M) tokens from the Balancer exploiter.

On Ethereum mainnet, this represents 73.5% of the ~6,851 osETH stolen earlier today,… pic.twitter.com/b43EGf92hm

— StakeWise (@stakewise_io) November 3, 2025

Distribution Terms and User Claims

While Balancer proposes an $8M reimbursement plan, repayments will be done in kind. Users will be given the same lost and recovered tokens. The processing of claims will take place via a special interface. Furthermore, LPs must accept the new terms to be able to receive their tokens.

Balancer will take snapshots of pool data before each exploit begins in order to distribute them accurately. The claim period will be between 90 and 180 days. Any unclaimed assets beyond this window will need a governance determination on how to use the assets.

The proposal is based on community consultations and legal consultations. Within the SEAL Safe Harbor Agreement, white-hat involvement is not in conflict with the expectations of regulators. Depending on approval, the portal for making claims might be online as early as December or January.

Additionally, the recovery of 5,041 osETH and 13,495 osGNO by StakeWise parallel will support their users on a different timeline. This consisted of 73.5% of the total osETH drained in the attack. They plan to implement pro-rata refunds to their community separately from Balancer’s effort. Meanwhile, movement of transfers from the original exploiter raised concerns, with 6,999 ETH recently sent to a new address. This simply indicated that the entity was willing to cash in via laundering channels.