Which DeFi hacks hit this week?

TLDR

This weeks DeFi hacks and exploits centered on previously reported large incidents that drove fresh fallout, plus a few new price?manipulation hits.

1. Major fallout resurfaced around the Balancer exploit (~$128 million) and Stream Finance losses (~$93 million), both spotlighted again this week as systemic risks rose (coverage).
2. Garden Finance was reported hit by a vulnerability costing users about $10.8 million (report).
3. Smaller attacks included two price?manipulation exploits flagged in real time by Forta (~$100k on Ethereum and ~$180k on BSC) (Forta update).

Deep Dive

1. Large Incidents

Balancer (BAL) and Stream Finance drove renewed this week headlines after earlier November events, keeping risk elevated across vaults and liquidity venues. Media recapped Balancers exploit at roughly $128 million and Stream Finances losses near $93 million, emphasizing how composability spreads impact across protocols and vaults even days later (coverage).

• Commentary this week focused on smart contract complexity, risk isolation at the vault level, and the need for circuit breakers and continuous audits, as large losses ripple through TVL and liquidity conditions (analysis above).

2. Mid-Sized Protocol Hit

Garden Finance was cited as suffering a vulnerability that cost users around $10.8 million, part of a broader slate of Web3 security incidents called out this week. The report pairs contract?level losses with social attack vectors, illustrating how user interfaces and backend logic both expand the attack surface (report).

• The same roundup noted social account compromise at Astra Nova, reinforcing that off?chain access controls can be as impactful as on?chain code in driving losses (context above).

3. Smaller Price Manipulation Attacks

A security network flagged two real?time exploits this week: an Ethereum vault swap without slippage protection (~$100k drained, mostly returned) and a BSC token manipulated via flash loans and zero minimums (~$180k), consistent with classic oracle and slippage?free price attacks (Forta update).

• These incidents underline basic hygiene: avoid unverified contracts and enforce slippage bounds. They also show attack patterns that repeat across chains and venues.

Conclusion

This weeks exploit chatter refocused attention on early?November heavy losses (Balancer and Stream Finance) while adding fresh mid?sized and small manipulation events. The common thread is brittle risk controls at both contract and interface layers. If you stay active in DeFi, emphasize vault risk isolation, slippage and oracle protections, and pause exposure when project comms or parameters look unstable.