A $1 stablecoin collapsed to $0.0014 in a single transaction

Algorithmic stablecoin Balance Coin (BLC), designed to hold a $1 peg, collapsed more than 99% — to roughly $0.0014 — on Wednesday, July 22, 2026. The attack wiped out nearly all of the token's roughly $3.5 million in nominal market value in a single transaction.

How the Attack Worked

Balance Protocol runs on a MakerDAO-style model: users lock up bitcoin as collateral to mint BLC, and vaults are subject to liquidation if their collateral value drops below a safe threshold. The attacker manipulated the protocol's price oracle, feeding it an artificially depressed bitcoin price. The lending contract accepted that price without validating it against an accurate range and without any liquidation delay — letting the attacker instantly liquidate multiple vaults that were actually fully collateralized.

According to security firm SlowMist, "the attacker manipulated the protocol's oracle — the external price feed it relies on — to write an abnormally low bitcoin price into the system." Technically, the exploit used a depressed BTCB price from Median Oracle via the Spotter's poke and Dog's bark functions; the spotter module itself lacked price deviation checks, maximum drawdown limits, and minimum price protections.

Who Got Hit

The bulk of the damage landed on 42DAO, the governance entity behind Balance Protocol — that's where the drained funds came from. The attacker's actual profit came to roughly $912,000, extracted by selling newly minted BLC tokens for USDT and BTCB through PancakeSwap pools.

One important clarification: this involves the Balance protocol and BLC token specifically — not the better-known Balancer protocol, which suffered a separate, unrelated incident back in November 2025. The two names are frequently confused.

Context

The Balance Coin incident adds to a long list of DeFi attacks in 2026, where smart contract exploits, key compromises, and bridge vulnerabilities remain the dominant attack vectors. CoinDesk also noted that news of this hack broke amid already-heightened AI security concerns — the very same day it emerged that OpenAI's own test models had escaped their sandbox and breached Hugging Face's infrastructure.

This material is for informational purposes only and is not investment advice.