Balance Protocol suffered an exploit on July 22, 2026, when an attacker drained $912,000 in BTCB from 42DAO vaults on BNB Chain. The attack used a manipulated Median Oracle price feed to trigger false liquidations, security firms Slowmist and Peckshield confirmed. Balance Coin (BLC), the protocol's stablecoin, crashed 99.92% from near $1 to about $0.000795 per Coinmarketcap data. The exploit targeted a collateralized debt system modeled on MakerDAO, where users lock BTCB and mint BLC against it. No private keys were compromised; the protocol accepted a false price input without verification, allowing the attacker to seize collateral and sell it on Pancakeswap for profit.
Attacker Exploited Median Oracle Price Feed to Drain Vaults
Security firms Peckshield and Slowmist confirmed the exploit within hours of the attack. Peckshield first estimated the loss near $915,000. Slowmist later refined that figure to about $912,000 and published a technical breakdown.
The attacker used the Spotter contract's poke function to push an artificially low BTCB price into the system's accounting contract. The oracle accepted the number without checking it against market prices. Healthy vaults suddenly looked insolvent. The Dog module, which handles liquidations, seized the collateral in a single transaction and the attacker sold it on Pancakeswap for a profit.
Slowmist called it a single transaction combo that exploited missing price protection and a missing liquidation delay in a Maker style system. Blockchain records point to a single transaction hash as the primary exploit path, along with an attacker wallet address, a victim contract, the Spotter contract, and the Dog contract used for liquidations. Investigators traced every step from the false price entry to the final sale on Pancakeswap.
Protocol Design Lacked Standard Price Safeguards
Several standard safeguards were reportedly missing from the design:
- No price deviation checks against outside markets
- No maximum drawdown limits on the oracle feed
- No price floor to catch obviously false readings
- No delay between a price update and a liquidation
Balance Coin traded near $0.995 to $1.00 before the attack. Within hours, it fell to roughly $0.0014, then slid further to between $0.0008 and $0.0013 on major trackers. Coinmarketcap later showed a price near an intraday low of $0.000795, a 24-hour decline of 99.92%.
Balance Coin Market Capitalization Dropped to $2,800
Before the attack, Balance Coin's circulating supply sat near 3.5 million tokens, giving it a nominal value close to $3.5 million. After the collapse, its market capitalization fell to roughly $2,800. Trading volume spiked to about $103,000 in 24 hours as holders exited and arbitrage traders picked through the remains.
The token's all time high was $1.42 in May 2025. The July 22 depeg became its new all time low. 42DAO has not announced a recovery plan or compensation for affected users. The drained BTCB remains under the attacker's control.
Some trackers logged thousands of transactions in the hours after the exploit, many of them buys, a pattern common when speculators chase a depegged token hoping for a rebound or a quick arbitrage trade. The activity did not restore the peg. Balance Coin's ranking on major aggregators dropped deep into the lower thousands, and liquidity that was already thin before the attack largely disappeared. Coinmarketcap stats say the circulating supply of BLC is self-reported and the coin has more than 18,000 holders.
FAQ
What happened to Balance Coin on July 22, 2026?
An attacker drained $912,000 in BTCB from 42DAO vaults on BNB Chain using a manipulated Median Oracle price feed. Balance Coin crashed 99.92% from near $1 to about $0.000795.
How did the attacker exploit Balance Protocol?
The attacker used the Spotter contract's poke function to push an artificially low BTCB price into the system's accounting contract. The oracle accepted the false number without verification, triggering liquidations that the attacker profited from by selling seized collateral on Pancakeswap.
What safeguards were missing from Balance Protocol's design?
The protocol lacked price deviation checks against outside markets, maximum drawdown limits on the oracle feed, a price floor to catch false readings, and a delay between price updates and liquidations.
