Balancer says $2.8M still at risk after vulnerability warning