TLDR
Over the past week, funds were hit in Balancer, Stream Finance, Hyperliquid, and Garden Finance, with losses ranging from about $5 million to over $120 million.
- The biggest loss involved Balancer pools tied to liquid staking tokens across multiple chains, with reports around $117$129 million stolen (industry recap).
- Stream Finances stablecoin xUSD depegged after an approximate $93 million loss, creating knock?on effects for creditors and integrated protocols (news analysis).
- Hyperliquid suffered roughly $4.9 million in vault losses from market?structure manipulation, not a code bug (incident coverage).
Deep Dive
1. LST Pool Exploit
Balancer (BAL) saw one of the biggest DeFi hits this week as attackers drained pools spanning Ethereum, Base, and Berachain, with totals cited near $117$129 million (overview). Stolen assets reportedly included WETH, wstETH, sfrxETH, osETH, and rsETH, reflecting how composable liquid staking token routes can magnify impact (technical recap).
Composability boosts utility but also attack paths. If you use LST?heavy strategies, isolate vault risk and watch for circuit breakers in pool design.
2. Stablecoin Contagion
Stream Finances xUSD stablecoin suffered an approximate $93 million loss and depeg, triggering creditor exposures and platform responses. A creditor post?mortem noted $14 million at risk and outlined legal steps, underscoring how rehypothecation and money?lego dependencies spread stress across protocols (creditor impact and timeline).
Stablecoin mechanics matter. If backing or borrowing loops are opaque, depegs can cascade into partner protocols and user positions even without direct exposure.
3. Non?Code Exploits
Hyperliquids loss near $4.9 million stemmed from liquidity manipulation in leveraged POPCAT perpetuals, not a smart?contract bug. The attacker used coordinated flows and synthetic buy walls to force liquidations, overwhelming the vault and prompting a brief bridge pause before normal operations resumed (case study).
Other incidents to note this week include Garden Finance, where users reportedly lost about $10.8 million, illustrating that both interface compromises and contract vulnerabilities remain active attack surfaces (roundup).
Defense is not just audits. Market?structure safeguards, depth monitoring, and position limits can mitigate manipulation even when contracts are sound.
Conclusion
This weeks losses cluster into three patterns: complex pool logic around LSTs, stablecoin design and dependency risks, and manipulation of thin or leveraged markets. The common thread is composability without strong isolation. For research and risk controls, prioritize vault?level circuit breakers, transparent backing, and market?structure guardrails, as these directly reduce blast radius when incidents occur.
CoinsKid.Com