Balance Coin crashes 99% after oracle attack drains $912,000 from 42DAO
- Balance Coin crashed roughly 99% on July 22 after an attacker drained almost $1 million from governance entity 42DAO.
- BLC holders are left with tokens worth a fraction of a cent, and to the wider DeFi market.
- The exploit relied on missing basic safeguards, price checks, and liquidation delays, rather than any sophisticated code break.
Balance Coin fell by ~99% on Wednesday, after an attacker distorted its BTCB price oracle and carted away with $912,000 out of the project’s treasury, losing almost all of its value.
Balance Coin (BLC) is an algorithmic stablecoin tied to the dollar; it’s built to trade at $1 and nothing more. It traded at around $0.9954 on Tuesday, but by early Wednesday, it had dropped to a fraction of a cent, trading at around $0.0014, with some other trackers putting it closer to $0.0025.
Either way, by late Wednesday, Balance Coin had lost almost all of its $3.5 million nominal value.
A deceptive Bitcoin price that made safe vaults liquidation targets
Balance Protocol uses a maker-style setup. It lets users lock collateral, typically Bitcoin Cash (BCH), as well as Binance-pegged Bitcoin (BTCB) and USDT, and mint BLC against it. Once the value of that collateral drops way below the debt, the protocol instantly liquidates the position and sells the backing.
The theft was traced to the protocol’s Median Oracle by SlowMist, a security firm. Median Oracle is the price feed that informs the system of how much BTCB is worth.
The attacker input an unusually low price into the feed via the ‘poke’ function on the Spotter’s contract and went on to trigger liquidations via the Dog module. In the words of SlowMist, the Spotter had no time-weighted average price feed, a bounds check that could reject prices deviating far away from the market, and a liquidation delay
Without those measures, safe vaults suddenly became insolvent, and the thief liquidated them at the fake price, walking away with the collateral all in one transaction.
Minted tokens routed directly through PancakeSwap
The theft continued beyond the vaults. The attacker minted ~4.5 million BLC from a null address via a corrupted GemJoin contract and those tokens to PancakeSwap V2, exchanging them for BSC-USD and BTCB; this converted freshly created coins into real assets.
A second transaction was reported two hours later that minted 5,900 BLC.
That wave of unbacked supply is what moved BLC off its target in real time. As the mechanism supposed to pin the peg was the same one the attacker used to break it.
The CertiK audit missed the fault
In the past, 42DAO had propped up the CertiK audit of its BLC minting contract as a mark of its security. However, that proved futile in this instance because while the audit was legit, standard smart-contract audits are looking for access-control errors, reentrancy, overflow, and coding flaws.
They typically see oracle inputs as trusted instead of seeing them as modeling a manipulated price feed as an in-scope threat.
Despite OWASP listing oracle manipulation in its 2026 Smart Contract Top 10, the measures that could have prevented the attack are outside the typical audit scope.
42DAO’s system had none of the following:
- A time-weighted average price feed
- A bounds check that could reject prices deviating far away from the market
- A liquidation delay similar to MakerDAO’s one-hour Oracle Safety Module.
The third BNB Chain protocol to go mute after an attack
Within the past two months, Wednesday’s incident became the third major DeFi security incident on BNB Chain. It is also the third incident where the team affected by the exploit stayed quiet.
Late May, approximately $7.3 million was stolen from DxScale’s legacy liquidity lockers. Early in June, TesseraDAO lost roughly $2.5 million when an attacker stole 99 million TSR, pouncing on an admin-key compromise.
This spate of attacks is consistent with a recent trend amongst attackers in 2026. Analysts noted that attackers are no longer looking to exploit code bugs but rather are focused on the oracles and governance layers around the code.
These attacks also happen at a time the market has grown wary of algorithmic stablecoins, especially after the collapse of Terra’s UST in 2022 and more recently the depegs of Ethena’s USDe and Abracadabra’s MIM.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
What caused Balance Coin to lose its dollar peg?
An attacker manipulated Balance Protocol's BTCB price oracle, feeding it an abnormally low bitcoin price that made overcollateralized vaults appear insolvent and let the attacker liquidate them and seize the collateral.
How much did the attacker take?
Security firms estimated the loss at roughly $912,000 (SlowMist) to $915,000 (PeckShield), drained from 42DAO, the governance entity behind Balance Protocol.
Why did the project's CertiK audit not prevent the attack?
Standard smart-contract audits review on-chain code for flaws like reentrancy and access-control errors, and treat oracle inputs as trusted, so a CertiK audit of the minting contract would not have flagged the missing price validation and liquidation delay that made the attack possible.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
