Stablecoins are designed to be reliable and predictable, but Balance Coin proved to be anything but on July 22, 2026. A flaw in how it received price data caused it to quickly lose its stable value, and the market never bounced back.
This article explains what went wrong in a recent incident, how the attacker profited from it, and why relying on just one source for price information can cause problems for stablecoins. You’ll learn how to evaluate whether a stablecoin is trustworthy and identify warning signs that suggest a potential collapse.
Balance Coin lost its stable value because the data feed showing its price in Bitcoin was intentionally altered. This caused automated liquidations of assets held as collateral. The attacker then created and sold large amounts of BLC, exploiting the low trading volume to steal collateral and erode trust in the coin. The attacker reportedly made around $900,000, while the value of BLC plummeted by over 99% within hours.
- On July 22, 2026 BLC fell about 99 percent, from around $1 to roughly $0.0014, erasing an estimated $3.5 million of nominal value (CoinDesk).
- SlowMist estimated attacker profit near $912,000 after manipulating the Bitcoin oracle and forcing improper liquidations of BTC-backed vaults (CoinDesk citing SlowMist).
- PeckShield’s tracing showed the attacker minted and dumped newly created BLC, routing via PancakeSwap into USDT and BTCB for roughly $912k–$915k in proceeds (CoinCentral citing PeckShield).
- CoinMarketCap recorded an all-time low near $0.0006345 and lists a supply around 3.51 million BLC with about 18.1k holders, showing how fast circulating value vanished (CoinMarketCap).
What exactly failed inside Balance’s design?
The issue stemmed from a flaw in how the system determined the price of Bitcoin. It used a source that could be easily manipulated, causing it to incorrectly identify healthy financial positions as risky. This led to the unnecessary and incorrect liquidation of those positions, creating a financial vulnerability.
When liquidations began, the system designed to manage debt seemed to create and sell new BLC tokens, which worsened the existing panic in the market. This combination of errors from Oracle and forced selling created a dangerous cycle. Even a small price change – just a few percentage points at the wrong time – could trigger a cascade, and markets with low trading volume quickly amplified the problem.
The details are still emerging, but security experts agree on what happened: someone exploited a vulnerable source of Bitcoin price data. This led to unfair liquidations of positions, followed by a rapid cycle of creating and selling tokens on decentralized exchanges, particularly PancakeSwap on the BNB Chain (as reported by CoinDesk and CoinCentral).
How did the attacker profit from an oracle nudge?
Imagine a scoreboard – if you could briefly alter the score, you could change the outcome of the game. In the world of DeFi, this is similar to artificially inflating or deflating a price on a market with low trading volume, or taking advantage of how a system gathers and calculates price data. By manipulating the price, a healthy account can be falsely marked as failing, triggering its liquidation. An attacker is then ready to seize the account’s assets or create new ones based on this false information.
The attacker exploited a vulnerability in Balance, creating and selling a large amount of BLC tokens. They quickly added these tokens to liquidity pools and sold them before most people noticed, effectively stealing value. Data shows the attacker used PancakeSwap to trade the BLC for USDT and BTCB, resulting in a loss of just under a million dollars, according to reports from CoinDesk and CoinCentral.
The order of events is crucial. If you create new tokens based on flawed information and then quickly try to sell them, you’ll struggle to find buyers at a good price. Those who sell early will get close to the expected value, but those who wait will be left with very little. People who held onto their tokens watched the value collapse because of the increased supply and the lack of a way to redeem them.
How big was the damage and who took the hit?
As a researcher tracking this, the situation with BLC is pretty stark. On July 22nd, the price essentially collapsed. We saw a drop of over 99% – CoinDesk reported around 99% to about $0.0014, which translates to roughly $3.5 million in value disappearing. CoinMarketCap data confirms this, showing an all-time low near $0.0006345 that same day. What’s also concerning is that, with a total supply of 3.51 million and around 18,100 holders, the impact of this crash was felt across a fairly wide, though still relatively small, investor base.
The person who profited from this situation was the one who caused the problem, and everyone else suffered losses. Those who had funds locked up in the system probably lost money due to unfair liquidations. People who held the token directly experienced its value dropping. Those who provided liquidity to BLC pools were left with tokens that were rapidly losing value while the stablecoin side of their holdings disappeared. Anyone who has provided liquidity to a failing stablecoin understands this feeling – you end up withdrawing mostly the asset that lost its value.
As an analyst, I’m seeing a ripple effect beyond the initial impact. Because BLC was used as collateral or for pricing assets in various protocols and treasuries, those balances are now showing reduced value. While the dollar amount might seem insignificant overall, these integrations create a much wider problem within the DeFi ecosystem – it’s expanding the scope of potential damage across multiple platforms.
What would have reduced the blast radius?
No security measure is foolproof on its own, but combining multiple layers of protection is a smart approach. The idea is to make it difficult and time-consuming for attackers, giving your team time to respond. Here are some ways to strengthen your defenses:
- Use robust oracles that aggregate across venues and resist quick nudges, with clear update thresholds and circuit breakers.
- Cap minting and liquidations per block, and throttle supply expansion, so one bad tick does not flood the market.
- Require delayed liquidations or multi-block confirmations when price inputs move outside normal bands.
- Introduce backstops such as surplus buffers, insurance modules, or off-chain redemptions when markets dislocate.
- Keep liquidity deep and diverse across pairs and venues so a single DEX route cannot absorb a dump cheaply.
It’s always easier to understand what went wrong *after* something fails. Predicting and preparing for issues – like managing resources and delays in a live system – is much more difficult. However, most major failures share common patterns. For example, problems with Oracle databases often happen alongside unlimited minting of assets.
How should you vet a stablecoin’s oracle and risk kit?
Don’t just read the project’s overview. Dig deeper and investigate. If the documentation is unclear about how the oracle works or how liquidations happen, that’s a red flag. If it *is* clear, double-check the information by looking at the blockchain data or the project’s code. Then, really put the system to the test in your mind. Imagine a significant price change – what would happen to borrowing, creating new tokens, and redeeming them in the next few minutes?
- Is the oracle sourced from multiple venues or a single DEX pair? Look for aggregation and update guards.
- Are there circuit breakers, pause switches, and supply caps that slow the system during anomalies?
- Is collateral transparent on-chain with dashboards that reconcile totals and liabilities?
- Are liquidations backstopped or open to anyone without rate limits? Who profits and how?
- Have audits covered oracle logic and liquidation math specifically, and is there an active bug bounty?
- What is the redemption path at par when the peg wobbles, and who funds it?
When it comes to stablecoins guaranteed by unpredictable assets such as Bitcoin, the technology that provides price data and manages sell-offs plays a bigger role in maintaining their value than the coin’s reputation or promotional materials. If these core technical components are weak, any other efforts to support the coin are just superficial.
Are there better oracle setups for BTC-backed stablecoins?
Oracle systems involve a trade-off between cost, speed, and security against manipulation. You can’t have it all, but some designs are more resistant to being exploited than others.
Here’s a breakdown of different oracle models used for getting price data:
DEX TWAP: This method uses the time-weighted average price directly from decentralized exchanges (DEXs). It’s quick and inexpensive because everything happens on the blockchain, but it can be influenced by large trades and isn’t reliable when there’s not much trading activity. Cost is low.
Centralized Exchange Medianizer: This model gathers prices from several centralized exchanges and calculates the median price. While harder to manipulate than DEX TWAP, it relies on external data sources and may experience some delay in updates. Cost is low to medium.
Aggregator Oracle Network: Decentralized networks of nodes collect price information from numerous sources. These are well-established, resistant to manipulation, and have been tested extensively. However, they typically involve higher fees and can be slow to react during periods of rapid price changes. Cost is medium to high.
Hybrid (On-Chain + Off-Chain): This combines the speed of DEX TWAP with signed price data from off-chain sources for added security. It aims to balance speed and reliability, and can include safeguards against sudden price swings. The downside is increased complexity and more code that needs auditing. Cost is medium.
When borrowing against Bitcoin as collateral, the most secure approach involves using data from multiple sources with pre-defined acceptable ranges, and a system that pauses activity if something looks off, giving the system’s managers time to check. If you have to rely on a decentralized exchange’s time-weighted average price, limit the amount that can be borrowed and set strict block-by-block limits to prevent someone from manipulating the price and draining the funds.
What should BLC holders or LPs do after a collapse?
It’s natural to want to buy more BLC or LP tokens after a price drop, but it’s important to be cautious. Price drops without a clear plan to restore the value to its original level rarely recover quickly. If there isn’t a solid plan backed by real assets and a specific timeline, any price increase is likely temporary.
Practical moves:
- Stop providing liquidity. You usually end up with the side that is falling.
- Revoke token approvals for BLC contracts and related routers until the dust settles.
- Check project channels for recovery or redemption proposals, and verify details on-chain.
- Document balances and transactions for any insurance claims or tax reporting later.
- Beware of opportunistic forks or IOUs that promise instant restitution without audits.
A good rule of thumb: If you can’t clearly describe how an investment will generate returns in just two sentences, you’re likely gambling on a temporary price increase rather than making a true investment. Adjust the amount you invest to reflect this risk.
What happens next for BLC and the wider market?
Stablecoins that rely on algorithms or partial collateralization almost never recover to their original $1 value after a significant drop unless new funds are added and stricter rules are put in place. Often, the community might decide to use existing funds to slowly buy back tokens, but sometimes the project simply ends. In either case, things usually don’t go back to how they were before.
This incident is another reminder of the risks in the cryptocurrency market. On the day it happened, analysts estimated the attacker gained around $912,000 to $915,000, and the affected token’s value dropped close to zero. This usually causes investors – both large institutions and individuals – to move their funds into more established and reliable stablecoins. Newer projects will need to be very transparent about how they ensure data accuracy (through oracles) in order to regain investor confidence.
Common Mistakes
- Chasing the dip on a broken peg. Without a funded redemption plan, price usually drifts lower as liquidity dries up. Demand proof, not promises.
- Providing liquidity during a depeg. You’ll withdraw mostly the depegged token. Pull the LP and minimize further inventory risk.
- Ignoring oracle details. If you can’t identify the price sources and deviation controls, assume the feed is gameable until proven otherwise.
- Overlooking per-block or per-transaction caps. Unlimited minting and liquidations turn a small oracle wobble into a flood. Caps buy time.
- Trusting screenshots over on-chain data. Verify supply, reserves, and exploit flows in a block explorer or reputable analytics tool.
For continued updates on incidents like this, and in-depth reporting beyond the initial news cycle, visit Crypto Daily.
Frequently Asked Questions
Is every oracle manipulation a flash loan attack?
Flash loans aren’t the main problem; they just highlight a deeper issue. The real concern is whether the price information being used can be manipulated. Problems like low trading volume, infrequent price updates, and relying on only one exchange are what truly cause issues. The way the loan is funded is less important.
Why do algorithmic or partially collateralized stables keep failing?
These systems rely on market activity to maintain their value. When the market is stable, the fixed value seems secure. But during times of stress, a cycle of problems can begin. If new units are created while the market is declining and it’s difficult to redeem them, the fixed value can quickly collapse.
Could a robust oracle alone have saved Balance?
While helpful, a good design considers everything together. Even the most reliable system needs safeguards like limits and a clear way to reverse actions. If you take away one essential part, the whole thing becomes unstable. Remove two, and it completely fails.
I LP’d BLC on PancakeSwap. What’s my smartest first step?
To protect your funds, first remove your assets from the platform to prevent further losses. Next, review and cancel any permissions you’ve granted to the affected token. Keep an eye on official announcements for any plans to recover funds directly on the blockchain. Finally, steer clear of any new opportunities that reward you with the same token that caused the problem.
How can I track whether an attacker still holds funds?
To stay informed, use a block explorer and follow trusted analysts online. Recently, experts tracked the creation and exchange of BLC tokens, finding they were converted into USDT and BTCB worth approximately $912,000 to $915,000 (according to CoinCentral, citing data from PeckShield). Be cautious of fake addresses and always double-check information.
Does a depeg create a taxable event?
Generally, you may need to report capital gains or losses when you sell or trade assets. Tax rules vary depending on where you live and the type of loss. It’s important to keep thorough records and consult with a tax advisor in your country for personalized guidance.
What would you watch before re-entering?
The project now includes a public review of past issues, a more reliable data source combining information from multiple places, a fixed maximum supply, limits on how much can be liquidated at once, and a clearly planned and funded way to redeem tokens, including specific deadlines. Once these features are live, we’ll re-evaluate how much of the asset to hold and how easily it can be bought or sold.
2026-07-24 15:08