Balancer is proposing an orderly shutdown after a post-exploit recovery failed to bring in enough revenue to keep the protocol worth running.
- More than $9 million in treasury assets would be distributed to BAL holders, after shutdown costs.
- Balancer would keep withdrawal rails open, then move into a limited wind-down mode.
- The November 2025 exploit did more than drain funds, it helped cripple trust, liquidity, and fee income.
Marcus Hardt, CEO of Balancer Labs, laid out the plan in a governance proposal published Monday. If BAL holders approve it in a snapshot vote running from Sept. 25 to Sept. 29, the protocol would begin a phased wind-down instead of trying to grind on and hope things magically improve.
Liquidity providers would have until Oct. 30 to prepare exits. Starting Nov. 1, Balancer would retain only the infrastructure needed to process withdrawals. The proposal also says protocol fees would be reduced to zero where existing contracts allow it, and up to $400, 000 would be reserved for shutdown costs.
The first distribution to BAL holders is scheduled for May 2027. A second distribution would follow later for leftover wind-down funds and any unclaimed assets. So no, this is not a quick payout. It is a controlled unwind with a long tail, because crypto shutdowns are rarely elegant and almost never fast.
Revenue never recovered
The reason for the proposed shutdown is blunt: the leaner post-exploit recovery did not restore enough revenue to justify keeping the protocol alive.
Hardt summed it up on X:
“What did not come was enough revenue. Most of the protocol’s revenue still comes from v2, and v3 revenue has not grown to replace it. The product worked. It did not sell enough, ”
That quote matters because it describes a very crypto reality that a lot of project teams hate admitting out loud: a protocol can be technically functional and still be economically dead. Code is not the business model. Liquidity is not guaranteed. Reputation is not a renewable resource.
According to DefiLlama data cited in the proposal, monthly protocol revenue fell from $1.13 million in October 2025 to $371, 000 in November, and later reached $56, 781 in August. Those figures do not suggest a healthy comeback. They point to a platform that kept bleeding user activity and fee income long after the initial shock.
Hardt also wrote on the governance forum that the November 2025 exploit “hit legacy v2 pools” and that “v3 is a different architecture, but the event followed the name into every conversation since and made traction harder to build.” In plain English: users often do not care which version was hacked. They remember the brand, the headline, and the fact that money disappeared.
He later said on X that Balancer had “underestimated how much the exploit would continue to limit adoption.” That is the ugly aftershock many DeFi teams learn the hard way. A hack is one event. The reputational drag can last far longer.
What happened in the exploit
Balancer suffered a major exploit on Nov. 3, 2025. Initial loss estimates were around $70 million, but later estimates rose above $128 million.
The attack targeted Balancer v2 Composable Stable Pools across several networks, including Ethereum and layer-2 networks. The technical cause was identified as a rounding bug in the “upscale” function, which handled token scaling in pool math. In DeFi, small accounting mistakes can become very expensive very quickly. One bad calculation, repeated across pooled assets, and suddenly the bill looks like a disaster movie.
Assets extracted in the exploit included WETH, osETH and wstETH. Some funds were recovered later. StakeWise regained roughly $19 million of osETH, representing 73.5% of the amount stolen in that asset. Balancer also previously proposed a framework to return roughly $8 million in rescued assets to affected liquidity providers.
Balancer DAO’s $128M Hack: Bounty Offer Sparks DeFi controversy also swirled around the recovery process, while the separate $8M recovery plan and KYC controversy raised the usual DeFi headache: how much “help” from centralized actors is too much before the whole permissionless purity routine starts to look like marketing fluff.
Gnosis Chain later activated a December hard fork to recover $9.4 million that had been frozen during the exploit. That kind of intervention is controversial in crypto for obvious reasons: it works, but it also makes the “code is law” crowd start choking on their coffee.
Why the wind-down matters
This is not just a sad ending for one DeFi protocol. It is a clean example of how a project can survive a hack technically and still become commercially unviable.
The damage was not limited to the stolen assets. The exploit hit confidence, trading activity, liquidity, and fee generation. Even after the immediate security response, the protocol could not get back to a revenue level that made sense for continued operation.
Balancer Labs itself had already shut down in March after financial pressure tied to the exploit in November 2025. The protocol was left running under a leaner structure, but the numbers still did not add up. At some point, continuing to burn treasury on a zombie recovery plan is just dragging the inevitable out for the sake of appearances.
Hardt put that tradeoff plainly:
“Continuing on the current path spends the treasury to arrive at the same place later. That treasury belongs to BAL holders, ”
“The question is whether what remains reaches holders while it is still substantial, or is spent first on a path that has already been tried.”
That is the real choice here. Holders can keep funding a protocol that never regained its footing, or they can cut losses and return what remains before more value gets swallowed by operating costs.
What an orderly wind-down means
An orderly wind-down is a managed shutdown, not a sudden rug pull or a chaotic abandonment. The idea is to keep withdrawal access working, settle outstanding obligations, and distribute remaining treasury assets in a controlled way.
In Balancer’s case, that means the protocol would shift into withdrawal-only mode. Users would still be able to remove funds, but the broader trading and liquidity activity that usually powers a decentralized exchange would be shut down.
The proposal would also send the remaining treasury assets, more than $9 million, according to the proposal, to BAL holders on a pro-rata basis, after reserving shutdown expenses. Treasury assets are the funds the protocol or DAO holds for operations or distribution. BAL holders are the governance token holders who get to vote on major decisions like this one.
A DAO, or decentralized autonomous organization, is the governance structure behind many DeFi protocols. In practice, it means token holders vote on decisions that would otherwise be made by a company board or executive team. Here, the snapshot vote from Sept. 25 to Sept. 29 will decide whether Balancer begins the shutdown path.
There are still a few open questions. Will holders approve the plan? Will the first distribution actually happen in May 2027? How much of the treasury survives wind-down costs and unclaimed assets? And can any more value still be recovered from exploit-linked funds? None of that is guaranteed.
What this says about DeFi
DeFi exploit cases like this are a reminder that a protocol does not need to be completely broken to die economically. In DeFi, a project can be patched, audited, and still lose the market because users do not come back.
That is the part of crypto most hype merchants gloss over. Technical recovery is not the same thing as commercial recovery. A codebase can keep running while the business case evaporates.
For token holders, that distinction is brutal. Governance tokens are often sold as a claim on future influence, future fees, or future growth. When the growth never returns, the token becomes a vote on how to wind things down instead of how to expand.
Balancer is choosing the cleaner path here: preserve withdrawals, stop pretending the comeback is just around the corner, and return what is left. It is not glamorous, but it is honest. Sometimes the least delusional move is to admit the market already answered the question.
Key questions and takeaways
-
Why is Balancer winding down?
Because post-exploit revenue never recovered enough to justify continuing operations, even after the protocol was cut back to a leaner structure.
-
Will users still be able to withdraw funds?
Yes. The plan keeps withdrawal infrastructure alive while the shutdown is carried out, and liquidity providers would have until Oct. 30 to prepare exits.
-
How much money could BAL holders receive?
More than $9 million in treasury assets would be distributed, though up to $400, 000 is reserved for shutdown costs first.
-
Was the exploit fully recovered?
No. Some value was recovered, including roughly $19 million of osETH by StakeWise and $9.4 million via a Gnosis Chain hard fork, but the overall damage remained severe.
-
What does this mean for DeFi?
A protocol can survive the technical fallout from a hack and still fail as a business if trust, liquidity, and fee revenue do not return.
