Gnosis Chain Executes Hard Fork to Recover $9.4M from Balancer Hack

Gnosis Chain has confirmed that it executed a hard fork to recover funds linked to the November 2025 Balancer exploit, which drained more than $116 million in digital assets. The update went live on December 22 and followed weeks of debate over whether network immutability could be temporarily suspended to return frozen user funds.

Funds transferred out of hacker’s control

According to an official announcement posted on Gnosis Chain’s X account, the network successfully activated the hard fork and “the funds are now out of the hacker’s control.” The statement urged remaining node operators to upgrade their clients to avoid penalties and to ensure they remain on the canonical chain.

The implementation follows a soft fork first introduced in November, which prevented the attacker from moving funds still held in Balancer-managed contracts on Gnosis Chain. While that measure froze the compromised assets, it left them inaccessible to both the attacker and affected liquidity providers, requiring a hard fork to complete the recovery.

Community divided over governance intervention

The decision to move forward with the hard fork has divided the Gnosis community. Supporters called it a responsible step to safeguard users, while critics warned about the precedent it sets for blockchain governance.

According to Philippe Schommers, Gnosis’ head of infrastructure, the fork was designed to restore user assets without removing the network’s core immutability principles.

“The hard fork requires relatively minor changes that do not affect chain history – and therefore do not affect fundamental immutability, which stands at the core of our ethos,” he said in a community post on December 12.

Schommers also noted that validators must decide collectively how and when to use such authority, adding,

“As it stands, our validators have a choice to exercise their collective power transparently, to protect users, even as we work toward a future where no one has that power at all.”

However, other community members, including one identified as MichaelRealT, cautioned that the move might signal an erosion of decentralization.

“Before we can move forward with the hard fork, it’s vital to define the process surrounding it so that all similar cases can be handled, and not just those that benefit one party or another,” they wrote.

Another forum participant under the name TheVoidFreak questioned the long-term effects.

“The greatest issue is the precedence if immutability is not a thing, then what prevents the DAO to overwrite blockchain state more frequently in the future?”

Details of the recovery process

The recovery operation originated from the Balancer V2 exploit reported on Balancer's X post on November 3, when attackers exploited a vulnerability to drain approximately $128 million in total from liquidity pools across multiple chains. On Gnosis Chain, validators immediately implemented a soft fork that blacklisted the attacker’s address and locked about $9.4 million in assets.

The hard fork now transfers those frozen funds into a DAO-controlled recovery wallet, fulfilling the proposal that Schommers first outlined earlier this month. He said the team aimed “to enable funds to be recovered by Christmas,” and promised continued discussion on how users can reclaim funds and how contributors to the effort will be recognized.

According to Balancer’s earlier statements, white-hat hackers had already returned about $28 million in separate recoveries. Still, the majority of the stolen tokens remain unrecovered across several affected blockchains.

Debate about immutability and network credibility

The Gnosis fork has raised fresh debate over the balance between user protection and blockchain immutability. Some network validators emphasized that this was an exceptional case tied to frozen funds, rather than an arbitrary rewrite. Others fear that future interventions could erode trust in permissionless systems.

Lefteris Karapetsas, founder of Rotki, wrote that the operation represents community accountability rather than centralization.

“The coordinated soft fork and the clear plan toward a hard fork show that Gnosis Chain takes security, users, and ecosystem responsibility seriously,” he said.

Meanwhile, calls have grown within the governance forum for clearer frameworks around future interventions that alter chain state, to ensure decisions are transparent and rare.

Outlook

The hard fork appears to have succeeded in isolating the attacker’s assets and enabling recovery efforts to continue under DAO oversight. Gnosis has stated that its validators now have the upgraded client in place, completing a key step in bringing frozen funds back under legitimate ownership.

While the move has reopened philosophical arguments about “code is law,” it has also demonstrated a coordinated community response to one of the largest decentralized finance exploits of the year.

Crypto Deal Volume Hits Record $8.6B In 2025 As Regulation Reshapes Institutional Strategy | HODL FM

Crypto mergers and acquisitions reached $8.6 billion in disclosed…

HODL FM: The Wildest Ride in the Crypto MarketOleksii Shumak

Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that despite the nature of much of the material created and hosted on this website, HODL FM is not a financial reference resource, and the opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice. HODL FM strongly recommends contacting a qualified industry professional.