Balance Coin stablecoin crashes 99% after oracle exploit drains $912K

Balance Coin, an algorithmic stablecoin on BSC, crashed more than 99% to $0.0014 after an attacker manipulated the protocol's bitcoin price oracle and drained roughly $912,000 from its governance entity, 42DAO.

"A single-transaction combo exploited the missing price protection and liquidation delay in Maker-style system, allowing an attacker to liquidate multiple BTCB vaults using an abnormally low oracle price and profit from the arbitrage," SlowMist, the blockchain security firm that identified the exploit, said.

The attacker fed an abnormally low bitcoin price into Balance Protocol's oracle on BSC, according to SlowMist. The lending contract accepted the price without validating it against a reasonable range and without enforcing any liquidation delay, enabling the attacker to instantly liquidate multiple Bitcoin-backed vaults that should not have been eligible. The seized collateral was then swapped for profit. PeckShield, another security firm, estimated the losses at $915,000. The token had traded near its $1 peg a day earlier, with a nominal market cap of roughly $3.5 million.

The exploit underscores persistent vulnerabilities in DeFi lending protocols that rely on external price oracles without adequate validation safeguards. Balance Protocol, which issues Balance Coin primarily backed by Bitcoin Cash per its GitBook, joins a growing list of DeFi projects hit by oracle manipulation attacks this year, raising questions about the security architecture of algorithmic stablecoins.

The attack on Balance Protocol follows a separate exploit over the weekend at Allbridge Core, a cross-chain stablecoin bridge, where a hacker used a flash loan to manipulate swap mechanics on Solana liquidity pools and stole $1.66 million. Allbridge said the pool's imbalance safeguard was "configured permissively," allowing mispricing to balloon before triggering.

Balance Coin is the native stablecoin of Balance Protocol, a DeFi project governed by 42DAO. The protocol allows users to lock Bitcoin-backed collateral to mint the stablecoin, with vaults subject to liquidation if collateral values fall below thresholds. The exploit targeted this liquidation mechanism by corrupting the price feed.

Blockchain data on BSCscan shows the exploit was executed in a single transaction. The attacker's actual profit of approximately $912,000 was drawn from 42DAO's treasury, according to PeckShield.

The incident adds to a string of DeFi exploits this year, with attackers continuing to target smart contract flaws, compromised admin controls and bridge vulnerabilities to siphon funds from onchain protocols.

This article is for informational purposes only and does not constitute investment advice.