Balance Coin, a small algorithmic stablecoin built to hold a $1 peg, fell more than 99% on Wednesday after an attacker manipulated the price feed behind its lending protocol and drained about $912,000 in a single transaction, according to on-chain data and security researchers.
The token had been trading near its $1 target a day earlier. It was most recently priced just below $0.0014.
Funds were taken from 42DAO
The stolen funds came out of 42DAO, the governance entity behind Balance Protocol. The protocol allows users to lock bitcoin-backed collateral to mint the stablecoin, and it liquidates those vaults if the collateral value drops too far.
According to security firm SlowMist, the attacker forced an abnormally low Binance-peg Bitcoin (BTCB) price into the protocol’s oracle and then used that price to seize collateral from vaults that should have been nowhere near liquidation.
SlowMist points to missing price protection and no liquidation delay
SlowMist described the exploit in a post on X: “A single-transaction combo exploited the missing price protection and liquidation delay in Maker-style system, allowing an attacker to liquidate multiple BTCB vaults using an abnormally low oracle price and profit from the arbitrage.”
In the firm’s account, the lending contract accepted the manipulated price without checking whether it sat within a reasonable range. The protocol also imposed no delay before liquidations, which let the attacker clear multiple vaults immediately and swap the seized collateral for profit.
PeckShield estimates roughly $915,000 in losses
Security firm PeckShield put 42DAO’s loss at about $915,000.
Unchained reported that the collapse erased nearly all of the token’s roughly $3.5 million in nominal value, leaving remaining holders with a stablecoin worth a fraction of a cent.
The report also said oracle manipulation remains one of the most dependable ways to break a lending market, and Balance Coin is the latest protocol to unravel after relying too heavily on its price feed.