How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation

On November 3, 2025 a sophisticated on-chain exploit abused rounding errors in Balancer V2 ComposableStablePool math (the _upscaleArray path) to suppress BPT prices via 65+ atomic micro-swaps and drain approximately $128.64M across multiple pools and networks; the attacker collected stolen value into the Vault internal balance during contract deployment and later withdrew it to a recipient address — the report provides root-cause code excerpts, transaction hashes, contract and actor addresses, and event evidence.