One of Ethereum’s top decentralized crypto trading projects, Balancer, is urging some of its customers to withdraw their tokens after the discovery of a critical vulnerability that could place tens of millions of crypto dollars at risk.

They’re listening in a big way: “People are withdrawing fast,” said Xenous, a pseudonymous contributor. The protocol’s TVL dropped nearly $100 million Tuesday amid the withdrawal rush.

Balancer, which supports trading of ether and other tokens with user-contributed liquidity pools instead of with traditional market makers, learned on Tuesday of a bug in its high interest-paying boosted pools.

The disclosure sent the decentralized protocol – it is governed by BAL token holders – into lockdown; Balancer’s crisis response group activated and hit pause on many pools to prevent their draining. But “there are some pools that could not be ‘paused’ and are therefore at high risk,” that Xenous said must be secured through user withdrawals.

Balancer’s latest estimate indicates 1.4% of total value locked – roughly $10 million – remains at risk.

The bug itself hasn’t yet been made public but project contributors expect to release a post mortem once things subside. They’ve already secured at least 80% of assets through the emergency actions.

Investors in BAL were spooked despite the orderly chaos. The token was trading around $3.44 at press time, down from its perch at $3.55 immediately prior to the disclosure.

“We are fine so far,” Xenous said. ”All partners are informed. No funds have been stolen so far.”