Balance Coin (BLC) collapsed by over 99% on Tuesday after DeFi protocol 42DAO suffered an exploit that security researchers estimate drained about $915,000. The attack occurred when the protocol’s Median Oracle fed an abnormally low BTCB price, allowing instant liquidations due to missing safeguards like price deviation checks and liquidation delays. The attacker triggered liquidations across several BTCB vaults in one transaction. BLC dropped from nearly $1 to $0.0025, with market cap falling to $12,000. The incident follows a pattern of DeFi exploits in 2026, including attacks on Allbridge, Syscoin, and Echo Protocol.
Balance Coin (BLC) collapsed by over 99% on Tuesday after DeFi protocol 42DAO suffered an exploit that security researchers estimate may have drained about $915,000 from the platform. The attack sent BLC from nearly $1 to fractions of a cent in one fell swoop.
The incident was first flagged by blockchain security firm PeckShield, which reported that 42DAO had been exploited for approximately $915,000. SlowMist later published a more detailed breakdown, putting the loss closer to $912,000 and tracing the root cause to 42DAO’s Median Oracle, which reportedly fed an abnormally low BTCB price into the system.
According to SlowMist, the attacker used the protocol’s Spotter poke function to write that bad price straight into the VAT contract since the Spotter lacked several safeguards. These included no price deviation checks, no maximum drawdown limits, and no minimum price floor protections.
Once the manipulated price entered the protocol’s accounting system, the Dog module picked it up with “no liquidation delay or oracle price validation,” allowing the attacker to trigger instant liquidations across several BTCB vaults in one transaction. SlowMist identified the bad actor’s wallet as 0x9d8d…231c and the victim contract as 0x973a…a9c0c.
The market reaction was swift, with data from GeckoTerminal showing BLC trading around $0.0025 at the time of writing, down 99.75% in the last 24 hours. The token’s market cap has also fallen to about $12,000, with trading volume at $94,900 across more than 1,600 transactions.
42DAO is the latest in a run of DeFi and bridge exploits this year. Other recent ones include an attack on Allbridge, a cross-chain stablecoin bridge, which was forced to pause activity on July 20 after a hacker made off with $1.65 million by manipulating stablecoin pool ratios using a flash loan.
In June, Syscoin suffered a bridge exploit that allowed an attacker to mint as many as 5 billion SYS tokens, triggering a near 20% drop in the asset’s price. A month before that, the Echo Protocol ended up suspending cross-chain transactions after an exploit involving the minting of 1000 eBTC, hurting its native token by more than 12%.
While the technical details differ, the 42DAO incident followed a familiar pattern where the exploit took advantage of missing safeguards around price feeds and liquidations rather than breaking cryptography or stealing keys.
