Balance, a stablecoin pegged to the US dollar, collapsed 99% in minutes on Wednesday after an attacker exploited a price oracle vulnerability. The exploit netted roughly $1 million by feeding a fake, abnormally low bitcoin price into the lending system, triggering liquidations of vaults that should have been safe. The entire attack happened in a single transaction.
How the exploit worked
The attacker manipulated the price feed that the lending protocol uses to determine whether vaults are properly collateralized. By submitting a false, extremely low bitcoin price, the system saw vaults as undercollateralized and liquidated them. The attacker then pocketed the difference between the real collateral value and the liquidation proceeds. The exploit required only one transaction, suggesting the attacker had prepared the fake price data in advance.
What users saw
Holders of the Balance stablecoin watched its value plunge from $1 to under a cent within minutes. The stablecoin lost its peg entirely and has not recovered. Vault owners who had borrowed against bitcoin collateral found their positions liquidated even though their loans were healthy under normal market conditions. The lending platform paused withdrawals shortly after the attack, but the damage was done.
Aftermath and open questions
The team behind Balance has not yet commented on the exploit or any plans for recovery. The stablecoin remains at near-zero value as of press time. It's unclear whether the protocol will attempt to fork or reissue tokens, or if the $1 million loss is covered by any insurance fund. The exploit highlights the fragility of price oracle systems in decentralized lending — a single manipulated data point can bring down an entire stablecoin.
