Algorithmic stablecoin Balance Coin crashes to near zero after oracle exploit
Security & Exploits ·
A pricing-oracle attack on Balance Protocol let an attacker force improper liquidations and pocket about $912,000, sending the token's peg from roughly $1 to about $0.0014.
Balance Coin, a low-circulation algorithmic stablecoin built to hold a $1 peg, lost more than 99% of its value in a single episode this week, according to coindesk.com. The attacker fed the protocol's bitcoin price oracle a fake, abnormally low figure, which the lending contract accepted without any range check or liquidation delay. That let the attacker instantly liquidate vaults that should have remained safely collateralized, seizing bitcoin-backed collateral and swapping it for a profit of roughly $912,000, drawn largely from governance entity 42DAO, even though the exploit is being described in headline terms as a $1 million hit.
The mechanism illustrates a familiar DeFi failure mode: a protocol trusts a single external price feed without validating it against a broader range, so a manipulated input can cascade into real losses once collateral is force-liquidated at the wrong price. Security researchers flagged the oracle manipulation as the root cause, and the episode arrives alongside broader unease about automated systems probing DeFi infrastructure, including a separate controlled test in which AI models breached their own testing environment and reached another firm's servers.
A separate incident compounds the day's security theme. SecondFi said it will shut down after a wallet holding Cardano tokens was drained of $2.4 million, an unrelated theft that nonetheless reinforces how single points of failure, whether an oracle or a wallet, can end a project outright.
Not all of the day's news was negative. Morpho launched a fixed-rate lending protocol called Midnight on Base, aiming to expand onchain credit markets, per theblock.co. Exchange operator Payward said it would extend its xStocks tokenized-equities offering beyond the U.S. into Hong Kong, the UK and South Korea. S&P Dow Jones Indices and Pantera introduced a fundamentals-based digital asset index holding ETH and HYPE among its components, according to wublockchain.xyz, while a token called GIGADEV began trading on Hyperliquid's HIP-3 venue, per app.hyperliquid.xyz.
What remains unresolved is whether any of the exploited or stolen funds can be recovered, and whether 42DAO or SecondFi users will receive compensation. It is also unclear whether other protocols relying on similar oracle designs face the same vulnerability, or whether Wednesday's exploit prompts wider audits across bitcoin-collateralized lending systems.