Key Takeaways
- An attacker drained $912,000 in BTCB from 42DAO vaults on BNB Chain on July 22, 2026.
- Balance Coin (BLC) fell 99.92%, from near $1 to about $0.000795, per Coinmarketcap data.
- Slowmist and Peckshield confirmed the exploit used a manipulated Median Oracle price feed.
Security firms Peckshield and Slowmist confirmed the exploit within hours of the attack. Peckshield first estimated the loss near $915,000. Slowmist later refined that figure to about $912,000 and published a technical breakdown of how the attacker pulled it off.
Balance Coin (BLC) traded near $0.995 to $1.00 before the attack. Within hours, it fell to roughly $0.0014, then slid further to between $0.0008 and $0.0013 on major trackers. Coinmarketcap later showed a price near an intraday low of $0.000795, a 24-hour decline of 99.92%.
How the Exploit Worked
Balance Protocol runs a collateralized debt system modeled on MakerDAO, now known as Users lock BTCB, the Binance pegged version of bitcoin, into vaults and mint BLC against it. A price oracle tracks the value of that collateral. When the ratio between debt and collateral drops too low, the protocol liquidates the vault.
The attacker used the Spotter contract’s poke function to push an artificially low BTCB price into the system’s accounting contract. The oracle accepted the number without checking it against market prices. Healthy vaults suddenly looked insolvent. The Dog module, which handles liquidations, seized the collateral in a single transaction and the attacker sold it on Pancakeswap for a profit.
Slowmist called it a single transaction combo that exploited missing price protection and a missing liquidation delay in a Maker style system. No private keys were compromised. The protocol trusted a number it should have questioned.
Blockchain records point to a single transaction hash as the primary exploit path, along with an attacker wallet address, a victim contract, the Spotter contract, and the Dog contract used for liquidations. Investigators traced every step from the false price entry to the final sale on Pancakeswap, giving a full account of how a legitimate-looking function call turned into a $912,000 payday.
Several standard safeguards were reportedly missing from the design:
- No price deviation checks against outside markets.
- No maximum drawdown limits on the oracle feed.
- No price floor to catch obviously false readings.
- No delay between a price update and a liquidation.
Market Fallout
Before the attack, Balance Coin’s circulating supply sat near 3.5 million tokens, giving it a nominal value close to $3.5 million. After the collapse, its market capitalization fell to roughly $2,800. Trading volume spiked to about $103,000 in 24 hours as holders exited and arbitrage traders picked through the remains.
The token’s all time high was $1.42 in May 2025. The July 22 depeg became its new all time low. 42DAO has not announced a recovery plan or compensation for affected users. The drained BTCB remains under the attacker’s control.
Some trackers logged thousands of transactions in the hours after the exploit, many of them buys, a pattern common when speculators chase a depegged token hoping for a rebound or a quick arbitrage trade. The activity did not restore the peg.
Balance Coin’s ranking on major aggregators dropped deep into the lower thousands, and liquidity that was already thin before the attack largely disappeared. Coinmarketcap stats say the circulating supply of BLC is “self-reported” and the coin has more than 18,000 holders.
Part of a Longer Pattern
Balance Coin is now one of a long list of stablecoins that failed to hold their peg. TerraUSD lost its dollar value in the May 2022 in a collapse that wiped out tens of billions of dollars and dragged its sister token LUNA to near zero. Circle’s USDC briefly de-pegegd in March 2023 after Silicon Valley Bank failed, though it recovered once reserves were confirmed safe. Smaller projects like Iron Finance, Beanstalk, and Acala’s aUSD suffered similar exploit-driven collapses in prior years.
Oracle manipulation is a recurring cause. Attackers feed a protocol a false price, the protocol reacts as designed, and value moves to the attacker before anyone can stop it. Balance Protocol copied the architecture of larger, more established systems like MakerDAO but left out the guardrails those systems added after years of near misses.
Why It Matters
Balance Coin’s market was small next to major stablecoins like USDT and USDC. Still, each exploit like this one adds to a pattern that regulators and users are watching closely. In 2026, stablecoin oversight in the United States operates under the GENIUS Act, which puts pressure on issuers to prove their reserves and their systems can hold up under stress.
For now, Balance Coin trades near zero. The BNB-based wrapped bitcoin collateral that once backed it sits in a wallet outside 42DAO’s control, and the protocol has yet to say what happens next.
