DeFi’s Chain Reaction: Balancer’s $128 Million Exploit Sparks Stream Collapse, Compound Freeze, and Elixir’s Synthetic Dollar Shutdown

A week of cascading failures exposed how deeply intertwined DeFi’s liquidity networks have become

TL;DR:

• Balancer’s $128 million cross-chain exploit triggered liquidity stress that rippled across multiple protocols.
• Stream Finance lost $93 million, causing its XUSD stablecoin to crash 76% and contaminate collateral markets.
• Compound froze key stablecoin markets after oracle distortions tied to Stream and Elixir’s deUSD exposure.

The most damaging DeFi contagion of 2025 unfolded in quick succession — a domino effect that began with Balancer’s cross-chain exploit and spread within 72 hours through Stream Finance, Compound, and Elixir. Together, they exposed more than $221 million in interconnected assets and revealed the systemic fragility of decentralized markets built on composable code, synthetic collateral, and leverage-driven yield loops.

The chain reaction began on Nov. 3, 2025, when Balancer suffered a $128 million exploit across six major blockchains: Ethereum, Arbitrum, Base, Sonic, Optimism, and Polygon. Attackers exploited an access-control vulnerability in Balancer’s V2 vault contracts that allowed unauthorized withdrawals from shared vault logic. Initial transfers siphoned roughly $70.9 million, including 6,850 StakeWise Staked ETH (OSETH), 6,590 WETH, and 4,260 wstETH, before losses mounted past $128.6 million. The exploit was compounded by Balancer’s composable design — code integrated by other protocols replicated the flaw across chains, turning one vulnerability into a systemic breach.

Berachain, a Balancer fork, was forced into an emergency hard fork to isolate its own exposure. Balancer confirmed the breach on X, saying its “engineering and security teams are investigating with high priority.” Security analysts later described the incident as “a classic permission oversight that metastasized through cross-chain composability.” The impact was immediate: liquidity providers withdrew capital from Balancer-linked pools, and the crypto price index dipped as investors adjusted for DeFi-specific risk, trimming billions from the coin market cap of decentralized assets.

As the market reeled, Stream Finance became the next weak point. On Nov. 4, the protocol disclosed a $93 million loss tied to an off-chain fund manager, halting deposits and withdrawals. The platform’s stablecoin, XUSD, plunged from near $1 to $0.24, a collapse of roughly 76%. Stream’s disclosures showed $160 million in user deposits and $520 million in total assets before the incident — meaning nearly $280 million in collateralized loans and strategies were compromised. Analysts identified the collapse as a chain reaction between off-chain fund exposure and on-chain leverage loops, where recursive yield positions unraveled faster than protocols could adjust oracles or liquidations.

By the same evening, risk-modeling firm Gauntlet issued an urgent proposal to Compound, warning that synthetic stablecoins tied to Stream — notably deUSD and its derivative sdeUSD, both connected to Elixir — had begun distorting risk parameters. Gauntlet highlighted that sdeUSD’s market price had fallen to $0.86 while the oracle continued to report $1.06, effectively inflating collateral valuations. Borrowers were able to overextend leverage on faulty data, posing an existential threat to Compound’s stablecoin markets.

Compound governance passed an emergency vote late on Nov. 4, enacting a pause on USDC, USDS, and USDT Comet markets to prevent cascading liquidations. Withdrawals and new borrows were frozen until liquidity rebalanced and oracles updated. When sufficient capital returned, withdrawals for USDC and USDS resumed, though USDT markets remained partially restricted. 

The contagion had already reached Elixir by this stage. The project, whose synthetic stablecoin deUSD was directly exposed to Stream’s unwind, moved quickly to contain damage. According to statements on Nov. 6, Elixir disabled all minting and redemptions of deUSD and began working toward full 1:1 redemptions in USDC. The team confirmed that Stream controlled around 90% of deUSD’s total supply — approximately $75 million — and had “decided not to repay or close positions.” To prevent further destabilization, Elixir halted functionality “to remove any risk of Stream liquidating deUSD before repaying their loan.”

In its public update, Elixir wrote, “We still believe this will be honoured 1 for 1,” adding that “any affected LPs in AMM pools or lending markets will be able to claim the full value of their position.” The statement reflected cautious optimism but also marked the end of Elixir’s ambition to sustain deUSD as a synthetic dollar backed by stETH and sDAI. The project’s earlier roadmap projected $1 billion in liquidity and partnerships with institutional investors — plans now derailed as Stream’s collapse undermined its balance sheet overnight.

On Nov. 8, Balancer’s DAO took a more direct stance toward recovery. The project issued an onchain ultimatum to the hacker behind the V2 Composable Stable Pools breach, giving them until Saturday to return the stolen assets in exchange for a bounty of up to 20%—potentially worth over $20 million. If ignored, Balancer vowed to pursue “technical, onchain, and legal measures” to recover the funds.

As of publication, no negotiations had occurred, and the stolen funds remained in a newly created wallet—casting further doubt over DeFi’s self-regulatory response mechanisms following cascading protocol exposures to Balancer liquidity.

The four events — Balancer’s exploit, Stream’s fund loss, Compound’s oracle crisis, and Elixir’s shutdown — occurred sequentially between Nov. 3 and Nov. 6, illustrating how deeply interconnected liquidity, collateral, and synthetic assets have become across decentralized markets. The episode stripped hundreds of millions from DeFi’s collective valuation and served as a harsh reminder that decentralization does not immunize the system from contagion. The week’s chain reaction showed how one breach of permission logic could escalate into a full-scale liquidity shock, reshaping not just protocol design but also market trust — and leaving a measurable dent in the global crypto price ecosystem.

This article has been refined and enhanced by ChatGPT.