A BUG THAT ALREADY COST $110 MILLION JUST TOOK $234,000 MORE — ONE SATOSHI BOUGHT THE WHOLE POOL — THE COMPANY THAT WOULD HAVE FIXED IT DISSOLVED IN MARCH

The attacker did not break any cryptography. He did arithmetic. Balancer’s pools work out what you owe using fixed-point math with eighteen decimal places. Wrapped bitcoin has eight. Push the pool’s wrapped-bitcoin balance close enough to zero with a few ordinary swaps and the function that prices a share of the pool rounds your bill all the way down to one satoshi — and still hands you the full share. Slowmist found it, published the attacker’s wallet and the attack contract, and the pool was out $234,000. Small money. The timeline is the part worth reading twice. This is the same family of bug that drained Balancer V2 of roughly $110 million last November. In March, Balancer Labs announced it was dissolving as a company, a co-founder writing that the corporate entity had become a liability. The code kept running, because that is what the code is for. There is nobody left to patch a V1 pool. There is nobody to email. The thing everyone wanted from smart contracts is exactly what is on display: it does what it says, forever, including when what it says is wrong. Bitcoin is not the failure in this story. Bitcoin is the collateral. Somebody’s coins were sitting in a wrapper, on somebody else’s chain, inside a function that no longer has an owner. Code you cannot stop is only a feature when the code is right.