Balance Coin (BLC) collapsed from its $1 peg to under $0.0012 at the time of writing, after an attacker exploited a price oracle vulnerability in the Balance Protocol, draining approximately $912,000 from 42DAO. The exploit wiped out nearly the entire $3.5 million market value. PeckShield and SlowMist confirmed the attack, which targeted the protocol’s Oracle Security Module, or rather, the lack of one.
How the exploit worked
Balance Protocol is a MakerDAO fork on BNB Chain where users deposit BTCB as collateral to mint the BLC stablecoin. The architecture uses two modules:
- Spotter, which records collateral prices
- Dog, which triggers liquidations
MakerDAO includes an Oracle Security Module (OSM) that introduces a one-hour delay and monitors abnormal price spikes. Balance Protocol omitted this protection entirely. The attacker manipulated the BTCB price in the Median Oracle, forcing Spotter to record an abnormally low price without any checks. Dog, using the already altered price without validation, immediately liquidated BTCB vaults that were actually collateralized.
The attacker also minted millions of unbacked BLC tokens and dumped them via PancakeSwap V2 for USDT and BTCB.
The lesson: Forks without safety rails
This attack points to a pretty common issue we see over and over in the decentralized finance (DeFi) world: developers copy successful blueprints but then drop the ball by skipping over the essential security layers. As SlowMist put it, “The code worked exactly as written. The safety rails were simply never built.”
42DAO, the group running the show behind Balance Coin, hasn’t put out a word on the situation just yet. The whole exploit is a massive reminder that oracle attacks are getting seriously dangerous, and they are definitely shaping up to be the absolute biggest headache for the entire DeFi space in 2026.
📌 Attacker: 0x9d8dd9f2d734675e2bfcc142d1c7a45609ca213c
📌 Victim: 0x973a722fd8bcd4b81f4c5c1ac687073e44aa9a0c
📌 Vulnerable Contract: 0x849dc2416cbe54995a1d725afe526c0e38829228 (Spotter) & 0x00101ae4467d72e83ef68df447c41de0c71f634e (Dog)
Oracle attacks: DeFi’s top risk in 2026
The Balance Coin exploit is part of a growing wave of oracle manipulation attacks that have become the most prominent DeFi security risk in 2026. Earlier this month, Ostium and Bonzo were hit using similar techniques.
It’s the same story every time: hackers manipulate price oracles to trigger fake liquidations, pocket the collateral, and print unbacked tokens to dump on exchanges. In every instance, the protocols involved either skipped vital safety tools like Oracle Security Modules (OSMs) or just didn’t bother with solid price checks and delay systems.
The decentralized nature of oracles (which aggregate price data from multiple sources) creates an attack surface that is increasingly being exploited.
For the crypto audience, the lesson seems clear: when evaluating a DeFi protocol, ask not just what code it copied, but what safety rails were left behind.
The market didn’t hold back either: the whole $3.5 million market cap for Balance Coin was basically wiped out in a single transaction.
