Date: July 21, 2026
Chain: BNB Chain
Loss: about $912K per SlowMist, about $915K per PeckShield
Class: missing oracle price bounds feeding an instant liquidation path
Before the attack on July 21, 2026, Balance Coin was trading at about $0.997, close to the dollar it was built to track. Within hours it had fallen 99.92% to an intraday low of $0.000795, according to CoinMarketCap data reported by Bitcoin.com, and the BTCB vaults that had been backing it were gone.
42DAO governs the Balance Protocol, the MakerDAO-style system that issues BLC against locked collateral. An attacker liquidated several of its BTCB vaults in a single transaction at an abnormally low BTCB price and kept the difference, which SlowMist put at about $912,000 and PeckShield at about $915,000. It was possible because the contract that publishes collateral prices to the system accepted that price with no limit on how far it could move, and the liquidation module acted on it immediately.
Balance Protocol borrows its architecture from MakerDAO. Users lock collateral such as BTCB, the Binance-pegged version of bitcoin, and mint BLC against it. The system tracks every vault in a core accounting contract called the Vat, and two modules sit next to it. The Spotter takes the price from an oracle, a contract that reports what an asset is worth, and writes it into the Vat through a public function called poke(). The Dog watches for vaults whose collateral is worth less than the minimum required and starts their liquidation through a function called bark(), which sells the collateral to cover the debt.
That loop is only as safe as the price moving through it. In MakerDAO's own deployment, an Oracle Security Module sits between the price feed and the Spotter and holds each new price for an hour before it goes live, which gives governance and monitoring time to reject a bad reading. A fork inherits the contract shapes automatically, and every one of the surrounding guards has to be carried over on purpose.
SlowMist's analysis traces the attack to 42DAO's Median Oracle, which reported an abnormally low price for BTCB. The Spotter had no price deviation check, no maximum drawdown limit and no minimum price floor, so when poke() ran, that price went straight into the Vat. 42DAO's own preliminary statement describes the same chain of events from the protocol's side: the attacker exploited weaknesses in its price-data validation and liquidation processes to submit an abnormally low BTCB price, and positions that shouldn't have been eligible for liquidation were liquidated.
The Dog then did what its code told it to. It read the new spot price, found healthy BTCB vaults that now looked undercollateralized, and let them be liquidated on the spot, with no liquidation delay and no sanity check on the price. With neither guard in place, a single bad number could travel from the oracle to a completed liquidation inside one transaction.
The idea a builder should take from this is that a price is an input like any other, and every function that accepts one needs a rule about what it'll refuse. A cashier who rings up a gold bar at a penny because the label says so has followed the label perfectly. The Spotter and the Dog both followed theirs.
The transaction landed at 21:00:01 UTC on July 21, in BNB Chain block 111,351,152, and SlowMist called it "a single-transaction combo" that exploited the missing price protection and liquidation delay in a Maker-style system. According to SlowMist, the attacker used poke() to push the low BTCB price into the Vat, then used bark() through the Dog to liquidate multiple BTCB vaults at that price, and pocketed the gap between the price the liquidations used and what BTCB was actually worth. The transaction's own logs show the Spotter's poke event for the BTCB collateral type, 10.74 BTCB leaving a protocol contract for the sending address, and 4,500,996 BLC minted to that same address.
That minted amount matches the roughly 4.5 million BLC that Stablecoin Insider cites PeckShield as reporting. Within the same transaction, the sending address sold the BLC into a PancakeSwap pool for 52,833.89 USDT and the BTCB into another PancakeSwap pool for 708,862.70 USDT, which is how a mispriced liquidation turned into stablecoins before the block closed.
BLC had about 3.5 million tokens in circulation and a market cap near $3.5 million before the attack, according to Bitcoin.com. Once the BTCB vaults were liquidated, the peg went with them. Cointelegraph's request for comment on July 22 went unanswered, and 42DAO published its preliminary statement on X on July 23. It said the team had suspended BLC minting, exchange and the affected functions, contacted trading platforms, stablecoin issuers and cross-chain providers to try to freeze and recover the assets, and would base compensation on an on-chain snapshot taken before the attack. It also said the published loss estimates vary with what they count and that none of them should be treated as 42DAO's confirmed figure. As of October 19, 2026, 42DAO's X account hadn't posted the confirmed loss, the snapshot block or the compensation plan that statement promised.
Olympix reads a contract the way an attacker does, as states, transitions and entry points, and it takes in the surrounding context, including the design a fork inherits, to infer the invariants the system depends on. In a Maker-style system the states that matter are vault collateral, debt and the spot price recorded in the Vat, and poke() and bark() are public transitions that anyone can call in sequence. The engine maps every path through them, narrows to the feasible ones, and keeps the paths that can touch an invariant.
The signal here is a public function that writes an oracle price into core accounting with no deviation, floor or drawdown bound, sitting next to a liquidation entry point that reads that same price in the same block. Olympix has flagged missing oracle price bounds before in other codebases. Maker forks name their price plumbing pip, peek and poke, and BugPoCer works from what those functions do to the system's state. It takes the whole CDP system as its starting point, works out what has to hold between collateral, debt and price, and runs Counterexample-Guided Invariant Refutation against every sequence of public calls that touches them.
For 42DAO, the invariant is plain: a vault that's solvent at the market price must not become liquidatable in the same transaction because of one unchecked price update. BugPoCer executes paths until one breaks that rule, and the shortest one is a poke() that writes an extreme low price followed directly by bark() on a healthy BTCB vault. Its output is a counterexample with the exact sequence of state changes, the minimal conditions that trigger it and a generated Forge test that replays it, which is the July 21 attack produced in development instead of on mainnet.
The engine runs automatically in development, at every merge and before release, so the guards a fork drops show up as broken invariants while the code is still changing.
Balance Protocol's Spotter and Dog each did what their code said, and the loss came from the guards that weren't there between them. Anyone shipping a fork of a mature design inherits its assumptions along with its contracts, and those assumptions are exactly what an engine can infer and test. If you're building on a Maker-style design or any system that turns an oracle price into liquidations, and you'd like to see which of your price paths a counterexample can break, book a technical walkthrough.
Protocol: 42DAO (Balance Protocol)
Chain: BNB Chain
Date: July 21, 2026, 21:00:01 UTC
Loss: about $912K per SlowMist, about $915K per PeckShield
Attacker (per SlowMist): 0x9d8d...213c
Exploit tx sender: 0x7b2e...399d
Victim contract (per SlowMist): 0x973a...9a0c
Spotter: 0x849d...9228
Dog: 0x0010...634e
BLC token: 0x5343...4668
Exploit tx: 0xe7ab...7628
Block: 111351152
SlowMist: 42DAO exploit analysis
PeckShield: 42DAO exploit alert
Bitcoin.com News: Another Stablecoin Bites the Dust as BLC Crashes From $1 to Near Worthless
42DAO: Preliminary Statement on the BLC Protocol Security Incident
Stablecoin Insider: Balance Coin Oracle Exploit
Cointelegraph: Balance Coin Crashes 99% After Reported $915K Exploit