Balance Coin dropped 99% after an attacker fed it a false price. Two standard safety checks were missing.
An attacker pulled roughly $912,000 from Balance Protocol in one transaction by tricking its price feed. The two safeguards that would have stopped it weren't there.
CryptoVibe Desk · defi · exploit · oracle
- →Balance Coin fell from $1.00 to about $0.0014 after an attacker fed a false bitcoin price to the lending contract.
- →SlowMist, cited by CoinDesk, said two standard safeguards were missing: a price check and a liquidation delay.
- →Watch for a 42DAO post-mortem and any BTC-collateral lender that pauses liquidations by July 25.
- oracle → An oracle is a data feed that tells a smart contract the current market price of an asset.
- liquidation → Liquidation is when a lending protocol sells a user's collateral because it no longer backs the loan.
- vault → A vault is where a borrower locks assets as security for a loan.
Balance Protocol's lending contract accepts a bitcoin price from a single external feed. No range validation. Today that was enough.
An attacker fed the contract an abnormally low BTC price. The contract accepted it without checking whether the value fell inside any valid range, per CoinDesk. It then liquidated vaults that should never have been eligible. The attacker walked out with roughly $912,000 in one transaction, according to CoinDesk. Balance Coin fell from $1.00 to about $0.0014. That's a 99% collapse, and roughly $3.5 million in nominal market cap gone.
Two checks would have caught this. The first is a price-range sanity check. Compare the incoming oracle value against another source, then reject values that are too far off. The second is a liquidation delay. Hold any liquidation trigger in a queue for at least one block before it executes. That stops one bad price from completing the whole attack in one transaction. Neither check was present, according to SlowMist as cited by CoinDesk.
And that's the catch. These are not exotic defenses. They are standard safety rails for lending contracts.
42DAO, the governance entity behind Balance Protocol, was the primary victim. No post-mortem has been published as of this writing.
If you're running a lending protocol with one oracle and instant liquidations, this is your bug too. The mechanism wasn't novel. It was a known gap that didn't get closed.
42DAO reopening deposits before a contract diff and post-mortem would be reckless. The failure was specific, simple, and already familiar to DeFi engineers.
Watch for any BTC-collateral lending protocol that pauses liquidations or announces an emergency audit by July 25, 2026. That action would show the exposure runs wider than Balance Protocol alone.
Primary links and supporting reads used by the desk for this story.
Forward this.
