Balance Coin stablecoin collapses 99% after $912k oracle exploit
In brief
- Balance Coin crashed 99% to $0.0014 after oracle pricing exploit
- Attacker manipulated bitcoin price feed triggering vault liquidations
- SlowMist identified $912k profit drained from 42DAO governance entity
How the attack unfolded
Balance Protocol runs a system where users lock bitcoin-backed collateral to mint the stablecoin, and vaults are liquidated if the collateral's value drops too far. The protocol relies on an external price feed (an oracle) to determine when liquidations should occur.
The attacker's exploit was direct: manipulate the oracle to write an abnormally low bitcoin price into the system. The lending contract then accepted that price without checking it against an accurate range and without any liquidation delay. This allowed the attacker to instantly liquidate multiple vaults that should never have been eligible for liquidation.
The damage
The attacker seized collateral from 42 vaults and swapped it for profit. The actual profit was approximately $912,000, drained from 42DAO, the governance entity behind Balance Protocol. It happened in a single transaction.
The collapse erased nearly all value from the stablecoin's ecosystem. What had traded near $1 a day prior now sits at a fraction of a cent, a stark reminder that even protocols designed to hold a peg can fail catastrophically if their price-checking mechanisms lack safeguards.
