Balance Coin (BLC), the dollar-pegged stablecoin issued by the DeFi protocol 42DAO, collapsed from its $1 peg to around $0.0013 after an attacker exploited a flaw in the protocol’s oracle system, draining roughly $912,000, according to blockchain security firms.
The Depeg
BLC, which is designed to hold a stable value of $1, fell approximately 99% within 24 hours, according to data flagged by PeckShield. The token, built on BNB Chain, traded near $0.001357 following the incident, effectively wiping out its peg.
Security firm SlowMist placed the loss at about $912,000, while PeckShield estimated it at roughly $915,000. The two figures point to a total in the range of $912,000 to $915,000.
A depeg of this severity is qualitatively different from a volatile token falling. BLC is the anchor of the Balance Protocol, a stablecoin that users mint by locking collateral such as BTC, ETH, and BCH. When the mechanism that maintains that peg is compromised, the token does not simply drop in price, it loses the property that defines it.
How the Exploit Worked
The attack targeted the protocol’s price and liquidation machinery rather than a token contract bug. According to SlowMist’s analysis, the attacker exploited an abnormally low BTCB oracle price drawn from a Median Oracle, pushing a manipulated spot price into the system through functions the firm identified as Spotter poke and Dog bark.
The failure was an absence of guardrails. SlowMist said the Spotter component lacked price deviation checks, maximum drawdown limits, and minimum price protections, which allowed the artificially low spot price to be accepted immediately. The liquidation module then used that price without any liquidation delay or secondary oracle validation.
That combination let the attacker liquidate multiple BTCB-collateralized vaults in a single transaction at the manipulated price, profiting from the gap between the false valuation and the collateral’s real worth. SlowMist described it as a single-transaction combo exploiting missing price protection and liquidation delay in a Maker-style system. The transaction has been recorded on-chain (tx: 0xe7abe6416…).
A MakerDAO Fork Without MakerDAO’s Safeguards
The component names in the analysis are the tell. Spotter poke and Dog bark are all lifted directly from MakerDAO’s contract architecture, meaning 42DAO built its protocol as a fork of Maker’s collateralized debt position system.
The distinction is what it left out. MakerDAO’s design includes an Oracle Security Module that delays price updates and validation logic intended to reject implausible price movements before they can trigger liquidations. The vulnerability SlowMist describes is precisely the class of attack those protections exist to prevent—a forked protocol that copied the liquidation engine but not the safety rails built around it.
Oracle manipulation of this kind is not a novel vector. Similar attacks on BSC lending protocols date back years, and the standard mitigation, using time-weighted average prices or a delay before acting on a new price, has been documented repeatedly. A system that acts on an instantaneous spot price with no deviation check remains exposed to the same manipulation each time.
Part of a Broader Pattern
The incident fits a trend that has defined DeFi exploits through 2026: attacks moving away from simple contract bugs and toward the oracles, governance rules, and infrastructure that surround the code. Recent months have seen the Ostium Perpetuals vault drained through manipulated oracle reports and the Bonzo lending protocol exploited via a third-party oracle feeding a forged price.
The common thread is that the vulnerable layer is increasingly the one that determines what a protocol believes an asset is worth, rather than the mechanics of how it moves that asset. Security assessments this year have repeatedly flagged that this surface is expanding faster than auditing practices have adapted to it.
42DAO had not issued a public statement on the incident or a recovery plan at the time of writing. For holders of a stablecoin now trading at a fraction of a cent, the mechanism that was supposed to return it to a dollar is the same one the attack broke.
Also Read: Crypto Loses Over $20M in a Week as Ostium, Across, Cascade Get Hacked
