What To Know:
- Berachain has started distributing hard fork upgrade files after the BEX exploit, with several validators already upgrading their nodes to restore full functionality.
- The attacker, identified as a white-hat hacker and MEV bot operator, has agreed to return the drained funds once the hard fork is finalized.
- The foundation confirmed that all recovered assets will be sent to the deployer address, with on-chain messages verifying the recovery process.
Ethereum-compatible Layer 1 blockchain Berachain has begun distributing hard fork upgrade files after last week’s exploit that targeted the Balancer-based BEX protocol. The attacker has been identified as a white-hat hacker who is ready to return funds. The foundation confirmed that several validators have already upgraded their nodes in an effort to restore the chain’s full functionality.
The Berachain Foundation said that its core infrastructure partners, including liquidation oracles and other key service providers, are now the main hurdle to resuming normal operations. Once these partners complete their RPC updates, the network will coordinate with bridges, centralized exchanges (CEXs), and custodians to resume on-chain activity.
In an update, Berachain revealed that the attacker responsible for draining funds from the BEX liquidity pool has come forward as a white-hat hacker and has agreed to return the assets. According to the team, the hacker, identified as an MEV bot operator who has been active on the network for months, has pre-signed transactions that will return the funds once the hard fork is finalized and the chain resumes block production.
Berachain confirmed that all recovered assets will be sent to its deployer address i.e., 0xD276D30592bE512a418f2448e23f9E7F372b32A2. On-chain messages have already been published by the deployer to verify this recovery process.
Berachain Breach and Emergency Network Halt
The incident began after an exploit targeted the Ethena/Honey tripool on Berachain via a complex smart contract transaction involving non-native assets. The vulnerability came from Balancer V2-related mechanics, which exposed liquidity providers across several blockchains to a coordinated drain.
After the detection of suspicious activity, Berachain’s validators intentionally halted the network to prevent further losses while developers implemented a permanent fix through an emergency hard fork. This pause was part of its containment strategy designed to secure user assets and rebuild trust.
“Some won’t be happy about this, and we recognize that this could be seen as a contentious decision,” said Smokey The Bera, Berachain’s Chief Smokey Officer, on X (formerly Twitter). “When approximately $12 million of user funds are at risk from a malicious attacker, coordinating the validator set to protect those users was the right call.”
The exploit affected multiple chains beyond Berachain, including Ethereum, Base, Optimism, and Polygon. Analytics platform Spot On Chain estimated the total stolen value at over $117 million, including 7,838 WETH (≈$29.1 million) and 6,841 osETH (≈$26.8 million), among several liquid staking tokens.
The decision to temporarily halt the blockchain drew mixed reactions from the crypto community. Supporters praised the team for acting decisively to protect user funds, while critics argued that freezing the chain undermines the principles of decentralization.
The Berachain team said that after the hard fork and validator upgrades are complete, a detailed post-mortem will be released outlining new safety measures across BEX and other core applications. The report will also include insights into protocol-level changes made to prevent similar incidents in the future.
Meanwhile, the foundation urged infrastructure partners to expedite updates so the network could return to full functionality soon. “Once the chain is live again, we will provide a rundown of the various safety measures implemented across BEX, other core apps, and Berachain as a whole,” the foundation stated.
The timing of the attack added further pressure to the project. Just two weeks earlier, Greenlane Holdings Inc. raised $110 million to support Berachain’s ecosystem, with participation from Polychain Capital, Blockchain.com, Kraken, and others. The investment demonstrated growing institutional interest in the Berachain ecosystem before the exploit disrupted operations.
Also Read: BNB Chain Completes Compensation for Oct 1 Security Attack Victims
