By late Wednesday, Balance Coin's $3.5 million nominal market cap had effectively gone to zero. The token, designed to hold a steady $1 peg, was changing hands at somewhere between $0.0014 and $0.0025, depending on which tracker you checked. A day earlier it sat at $0.9954. That collapse happened in a single morning, July 22, after an attacker fed a fake Bitcoin price into the protocol's oracle and walked away with $912,000 from the 42DAO treasury.

Security firm SlowMist traced the entry point to Balance Protocol's Median Oracle, the price feed that tells the system what BTCB, Binance-pegged Bitcoin, is worth. The attacker called the 'poke' function on the Spotter contract and submitted an artificially low BTCB price. That alone shouldn't have been enough, but the Spotter was missing three basic safeguards: a time-weighted average price feed, a bounds check to reject prices far outside market range, and any kind of liquidation delay.

How the vaults became the target

Balance Protocol works like a maker-style lending system. Users lock collateral, BCH, BTCB, or USDT, and mint BLC stablecoins against it. When the collateral value drops below the debt threshold, the protocol liquidates the position automatically via a module called Dog. With a manipulated price treating real Bitcoin as nearly worthless, every vault holding BTCB suddenly looked insolvent. The attacker triggered those liquidations at the fake price and claimed the underlying collateral in a single transaction.

The damage didn't stop there. The attacker also minted roughly 4.5 million BLC from a null address through a compromised GemJoin contract, then routed those freshly created tokens through PancakeSwap V2, swapping them for BSC-USD and BTCB. Newly printed coins became real assets. The total haul came to approximately $912,000, close to the $1 million figure that circulated in early reports.

What stands out is how little technical sophistication the attack required. No obscure code vulnerability, no flash loan acrobatics. The attacker simply fed a bad number into an unguarded price feed and let the protocol's own liquidation engine do the rest. BLC holders are now sitting on tokens worth a fraction of a cent, with no clear path to recovery announced as of publication.

This article is for informational purposes only and does not constitute financial advice.