
In short
- Balancer outlined a plan to return approximately $8 million in rescued assets to affected liquidity providers after a $128 million exploit.
- The proposal details pool-specific fees, snapshot-based distributions, and 10% white hat premiums capped at $1 million. In total, around $28 million was rescued through whitehat actions, internal bailouts and third-party interventions, with StakeWise handling separate refunds to its own users.
Decentralized finance protocol Balancer has outlined a framework to return millions in rescued assets to liquidity providers after an exploit drained more than $128 million from V2 pools, in what was one of the biggest DeFi exploits of the year.
The proposal published Thursday by two members of the Protocol community, is seeking community feedback on plans to distribute approximately $8 million in funds, “including both white hat rescues and internal recovery efforts.”
The discussion comes in the wake of The abuse of Balancer early this month, losing millions across five chains, forcing emergency pauses and fueling whitehat interventions.
About $28 million of the stolen money was rescued through a mix of white hat interventions, internal rescues and third-party actions, according to the proposal.
“Incidents like this show how important it is for DeFi to have clear, real-time visibility into what’s happening on the chain,” Blockscout, an open-source block explorer for EVM-based chains, told me. Declutter. “The more transparent and traceable protocols become, the faster the ecosystem can respond, limit damage and recover money.”
The framework will only cover the $8 million recovered directly by whitehats and Balancer’s internal teams, while Ethereum-based liquid staking protocol StakeWise will refund the remaining $19.7 million worth of osETH and osGNO separately to its own users through its governance process.
“The Safe Harbor Agreement adopted by Balancer DAO provides clear terms and conditions for white hat interventions,” the proposal notes, specifying that premiums will be paid in the same tokens as recovered funds and cannot be withheld directly from rescued assets.
The proposal takes a non-socialized approach to reimbursement, meaning that funds recovered from each affected pool will be distributed only to the liquidity providers of that specific pool and network, rather than spreading the losses across all users.
Distributions will be proportional to ownership in specific snapshot blocks taken immediately prior to the first operating transaction.
Whitehat rescuers who intervened during the attack will receive a 10% bounty, capped at $1 million per operation, once they complete legal ID disclosure, KYC checks and sanctions screening, the platform said.
The proposal identified six white hat actors who recovered approximately $3.9 million across multiple networks during the exploit.
Among them, anonymous whitehat “Anon #1” led the recoveries, saving $2.68 million Polygonincluding 8 million WPOL, 6.8 million MaticX, 2.9 million TruMATIC and 72,000 stMatic tokens.
Balancer also conducted an internal rescue operation, in partnership with security firm Certora, recovering an additional $4.1 million from vulnerable metastable pools around the world. Ethereum, OptimismAnd Arbitration who were at risk but not yet exploited.
These internally rescued funds are not eligible SEAL Safe Haven premiums because Certora operated under an existing service relationship with Balancer, and the agreement specifically incentivizes external actors rather than coordinating internal responses, according to the proposal.
A claims mechanism will be developed requiring claimants to provide digital evidence of agreement to Balancer’s terms and conditions, expressly agreeing to release Balancer Labs, Balancer DAO, Balancer Foundation and affiliated parties from liabilities related to the exploit.
The framework includes a 180-day claim period, after which unclaimed assets are classified as dormant and only reallocated via a subsequent board decision.
Daily debriefing Newsletter
Start every day with today’s top news stories, plus original articles, a podcast, videos and more.

