On July 22, 2026, Balance Coin (BLC) collapsed from roughly $1 to $0.0014 after an attacker exploited a manipulable Bitcoin oracle. The depeg wiped out an estimated $3.5 million in nominal value, with the attacker pocketing around $900,000 by minting and dumping BLC on PancakeSwap.
How the oracle was gamed
The attacker manipulated the Bitcoin price feed that Balance Coin relied on, causing the system to liquidate healthy BTC-backed vaults. Once the vaults were improperly liquidated, the attacker minted new BLC and sold it into liquidity pools. SlowMist pegged the profit at roughly $912,000; PeckShield traced proceeds between $912,000 and $915,000. The sales were routed through PancakeSwap, where BLC was converted into USDT and BTCB.
Who got hurt
Vault owners lost their collateral to the bogus liquidations. Spot holders saw their tokens become nearly worthless. Liquidity providers on PancakeSwap ended up holding mostly devalued BLC. CoinMarketCap recorded an all-time low of about $0.0006345 for BLC, with a total supply of roughly 3.51 million tokens and about 18,100 holders. The nominal value wiped out — $3.5 million — is a fraction of what many DeFi hacks cost, but the speed of the collapse caught users off guard.
Lessons for DeFi protocols
The incident is a textbook oracle attack: a single price feed became a single point of failure. The article that reported the exploit suggests stacking defenses — making exploits expensive and slow, and giving governance time to react. No recovery plan has been announced for BLC holders or LPs. For now, the token trades at a fraction of a cent, and the attacker's haul remains on the move.
