Balance Coin Drops 99% After Reported $915K Exploit

Balance Coin, the dollar-pegged stablecoin issued by Balance Protocol, has suffered a dramatic collapse after an exploit report said attackers manipulated a price oracle and liquidated collateral across multiple BTCB vaults.

According to CoinMarketCap, Balance Coin was trading at around $0.001358 at the time of writing, down from roughly $0.9954, reflecting losses of more than 99% tied to the incident.

Key takeaways

• Balance Coin’s peg failed after a reported exploit, with the token down more than 99% versus its $1 target.
• SlowMist attributes the attack to oracle manipulation—specifically an “abnormally low” Binance Bitcoin (BTCB) oracle price.
• The alleged method enabled multi-vault liquidations that should not have been liquidatable, followed by profitable swaps.
• PeckShield linked the incident to losses of $915,000 for 42DAO, citing 42DAO as the Balance Protocol governance entity.

Oracle manipulation blamed for the peg break

Blockchain security firm SlowMist said the exploit began with the attacker manipulating an “abnormally low” oracle price for Binance Bitcoin (BTCB). The firm claims this artificial price input allowed the attacker to trigger liquidations that, under normal conditions, should not have been possible.

SlowMist’s analysis describes a “single-transaction combo” approach that exploited what it characterized as missing price protection and a liquidation delay in a Maker-style system. In that framework, an extreme oracle price can cause vault collateral to appear undercollateralized, even if it would not be under a reliable reference price.

As described by SlowMist, the attacker used the manipulated oracle value to liquidate collateral across multiple BTCB vaults and then swapped the extracted assets to capture arbitrage profit.

Why liquidating multiple vaults matters

Liquidations are typically governed by a protocol’s collateralization thresholds, oracle pricing, and—critically—timing controls such as delays or safeguards intended to reduce the chance that brief oracle anomalies translate directly into economic loss.

SlowMist’s account suggests those layers were insufficient against this specific attack path. If an attacker can submit a transaction sequence that both bypasses price-protection logic and collapses the time window created by liquidation delay, then the damage can scale quickly—potentially across multiple vaults in one go—rather than being limited to a single position.

That scaling effect is a key reason DeFi incidents like this often produce outsized damage relative to how long the underlying vulnerability may have existed.

Reported losses and Balance Protocol’s collateral base

PeckShield said the exploit has resulted in $915,000 in losses to 42DAO, which it identified as the governance entity for Balance Protocol. PeckShield also stated the losses were associated with 42 entities, reflecting the breadth of impact across the protocol’s vaults or collateral positions.

Balance Protocol is a DeFi project that issues Balance Coin, a stablecoin intended to track the US dollar. According to the project’s GitBook whitepaper, Balance Coin is primarily backed by Bitcoin Cash.

Cointelegraph contacted 42DAO for comment. The outcome of that inquiry was not included in the information available at the time of publication.

Part of a broader pattern of DeFi exploits

Security concerns have continued to cluster around DeFi’s composability and reliance on infrastructure components—especially oracles, administrative pathways, and cross-chain mechanics. The reported Balance Coin incident adds to what has been described this year as a wider run of DeFi hacks in which attackers targeted smart contract logic flaws, compromised admin controls, and vulnerabilities in bridges.

In this case, the central theme is the interaction between oracle data and liquidation mechanics. For traders and liquidity providers, that matters because stablecoin trust can erode rapidly when market mechanisms are disrupted—particularly when the token’s peg depends on protocols that may be forced into liquidation events during oracle-driven exploits.

For developers and protocol operators, the broader implication is that safeguarding liquidation flows requires more than setting thresholds; it also depends on the resilience of oracle inputs and the effectiveness of timing- and protection-related controls under adversarial conditions.

What to watch next

Investors and users will likely focus on whether Balance Protocol can demonstrate remediation—such as strengthened oracle protection and liquidation safeguards—and how quickly liquidity and redemption pathways (if any) are restored after a near-total peg breakdown. Additional technical details about the exploit method, and any governance or security disclosures from 42DAO, will be crucial for assessing whether similar oracle-driven liquidation failures could recur.