Balance Coin, an algorithmic stablecoin built on BNB Chain, lost more than 99% of its value on July 22, 2026, after an attacker manipulated a price oracle and drained roughly $912,000 in bitcoin-backed collateral from vaults controlled by 42DAO, the protocol’s governing organization.
Key Takeaways
An attacker drained $912,000 in BTCB from 42DAO vaults on BNB Chain on July 22, 2026.Balance Coin (BLC) fell 99.92%, from near $1 to about $0.000795, per Coinmarketcap data.Slowmist and Peckshield confirmed the exploit used a manipulated Median Oracle price feed.The attacker used the Spotter contract’s poke function to push an artificially low BTCB price into the system’s accounting contract. The oracle accepted the number without checking it against market prices. Healthy vaults suddenly looked insolvent. The Dog module, which handles liquidations, seized the collateral in a single transaction and the attacker sold it on Pancakeswap for a profit.
Blockchain records point to a single transaction hash as the primary exploit path, along with an attacker wallet address, a victim contract, the Spotter contract, and the Dog contract used for liquidations. Investigators traced every step from the false price entry to the final sale on Pancakeswap, giving a full account of how a legitimate-looking function call turned into a $912,000 payday.
Several standard safeguards were reportedly missing from the design:
No price deviation checks against outside markets. No maximum drawdown limits on the oracle feed. No price floor to catch obviously false readings. No delay between a price update and a liquidation. Market FalloutBefore the attack, Balance Coin’s circulating supply sat near 3.5 million tokens, giving it a nominal value close to $3.5 million. After the collapse, its market capitalization fell to roughly $2,800. Trading volume spiked to about $103,000 in 24 hours as holders exited and arbitrage traders picked through the remains.
The token’s all time high was $1.42 in May 2025. The July 22 depeg became its new all time low. 42DAO has not announced a recovery plan or compensation for affected users. The drained BTCB remains under the attacker’s control.
Some trackers logged thousands of transactions in the hours after the exploit, many of them buys, a pattern common when speculators chase a depegged token hoping for a rebound or a quick arbitrage trade. The activity did not restore the peg.
Balance Coin’s ranking on major aggregators dropped deep into the lower thousands, and liquidity that was already thin before the attack largely disappeared. Coinmarketcap stats say the circulating supply of BLC is “self-reported” and the coin has more than 18,000 holders.
Part of a Longer PatternOracle manipulation is a recurring cause. Attackers feed a protocol a false price, the protocol reacts as designed, and value moves to the attacker before anyone can stop it. Balance Protocol copied the architecture of larger, more established systems like MakerDAO but left out the guardrails those systems added after years of near misses.
Why It MattersBalance Coin’s market was small next to major stablecoins like USDT and USDC. Still, each exploit like this one adds to a pattern that regulators and users are watching closely. In 2026, stablecoin oversight in the United States operates under the GENIUS Act, which puts pressure on issuers to prove their reserves and their systems can hold up under stress.
For now, Balance Coin trades near zero. The BNB-based wrapped bitcoin collateral that once backed it sits in a wallet outside 42DAO’s control, and the protocol has yet to say what happens next.
