Audit log

Every state-changing event for Balance Coin (BLC) Oracle Manipulation / 42DAO: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-29 12:32:05Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   8op2aZEXETMW…2bgqE1BGcopysha256 → base58

   verifying row…

   canonical bytes (19487 B) ▸

   {"actor":"system:backfill","investigation_id":"f7e8927f-c246-405f-843b-763fbb6ec79e","kind":"publish","page_slug":"balance-coin-blc-oracle-manipulation-42dao","published_at":"2026-07-29T12:32:05.345Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Balance Coin (BLC) Oracle Manipulation / 42DAO","sections":[{"content":"42DAO is the decentralized autonomous organization governing the Balance Protocol on BNB Chain (BSC). The protocol issues Balance Coin (BLC), a USD-pegged stablecoin backed by collateralized debt positions, following an architecture derived from MakerDAO. The BLC token contract is deployed at address 0x5343b4586a3f2a3365df92ee705c3bf446c54668 on BSC. Governance rights are held by FTD token holders, who vote on protocol decisions. The BCH Ecosystem Fund is identified in protocol documentation as a founding member providing funds, resources, and strategic cooperation. Individual founding team members are not publicly disclosed. The protocol received a CertiK audit delivered on January 27, 2025, covering the BLC Minting smart contract. The audit identified 13 findings: 0 critical, 1 major (centralization), 4 medium (logical issues), 5 minor (volatile code), and 3 informational (design issues). All 13 findings were acknowledged by the team but none were resolved or partially resolved at the time of the exploit.","heading":"Protocol Overview","severity":"medium","sources":[{"credibility":2,"name":"Intro to 42DAO - GitBook","type":"official","url":"https://42dao.gitbook.io/42dao/42dao/intro-to-42dao"},{"credibility":1,"name":"42DAO CertiK Audit - Skynet","type":"research","url":"https://skynet.certik.com/projects/forty-two-dao"},{"credibility":1,"name":"42DAO: BLC Token on BscScan","type":"on_chain","url":"https://bscscan.com/address/0x5343b4586a3f2a3365df92ee705c3bf446c54668"}]},{"content":"On July 22, 2026, an attacker exploited the Balance Protocol's Median Oracle on BNB Chain, draining between $912,000 and $915,000 in a two-stage attack executed approximately two hours apart. Security firms PeckShield and SlowMist independently identified and analyzed the incident; on-chain activity was also flagged by TenArmor. According to SlowMist's analysis, the attacker used the protocol's Spotter `poke` function to inject an artificially low BTCB (Binance-pegged Bitcoin) price directly into the VAT accounting contract. The Spotter module lacked price deviation checks, maximum drawdown limits, and minimum price floor protections. With the false price accepted, the Dog liquidation module's `bark` function was triggered, initiating automated liquidations of multiple overcollateralized BTCB-backed vaults as if they were insolvent. The attacker stepped in as the liquidator, acquiring BTCB at the manipulated below-market price. Concurrently, approximately 4.5 million BLC tokens were minted from a null address via the compromised GemJoin contract. These tokens were transferred to PancakeSwap V2 and swapped for BSC-USD (Binance-pegged USDT) and BTCB, extracting real value from liquidity pools. A near-identical second transaction executed roughly two hours later minted an additional 5,900 BLC tokens and drained further liquidity, indicating the absence of any circuit breaker or pause mechanism in the protocol.","heading":"Oracle Manipulation Exploit (July 22, 2026)","severity":"critical","sources":[{"credibility":2,"name":"42DAO's BLC Stablecoin Depegs to Near Zero After $912K Oracle Exploit - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/22/42daos-blc-stablecoin-depegs-to-near-zero-after-912k-oracle-exploit/"},{"credibility":2,"name":"Balance Coin crashes 99% after oracle attack drains $912,000 from 42DAO - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/balance-coin-crashes-after-oracle-attack/"},{"credibility":2,"name":"Balance Coin (BLC) Plummets 99% Following $915K Oracle Exploit on BNB Chain - Blockonomi","type":"news_article","url":"https://blockonomi.com/balance-coin-blc-plummets-99-following-915k-oracle-exploit-on-bnb-chain"},{"credibility":2,"name":"Balance Coin Crashes 99% After $915K 42DAO Exploit - LiveBitcoinNews","type":"news_article","url":"https://www.livebitcoinnews.com/balance-coin-crashes-99-after-915k-42dao-exploit/"},{"credibility":2,"name":"42DAO Oracle Exploit Crashes Balance Coin (BLC) 99% After $912K DeFi Hack - CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/162be-42dao-oracle-exploit-crashes-balance-coin-blc-99-after-912k-defi-hack"},{"credibility":2,"name":"Balance Coin Collapses 99% After Reported $915K Exploit of 42DAO - TFTC","type":"news_article","url":"https://www.tftc.io/balance-coin-42dao-exploit-blc-crash-99-percent"}]},{"content":"Security analysts identified several missing safeguards that collectively enabled the exploit. The Balance Protocol was architected as a MakerDAO fork but omitted the Oracle Security Module (OSM), which in MakerDAO imposes a one-hour delay on price updates and rejects implausible price movements. Without an OSM equivalent, the system acted on an instantaneous spot price with no deviation check. Specific absent protections included: no price deviation limits on the Spotter contract; no minimum price floor preventing extreme low values from being written to the VAT; no maximum drawdown limitation; no time-weighted average price (TWAP) feed as a secondary check; and no liquidation delay before the Dog module executed vault liquidations. The GemJoin contract, which governs collateral deposit and BLC minting, allegedly permitted minting from a null (zero) address, enabling the attacker to create unbacked tokens without genuine collateral. The protocol's CertiK audit, while identifying unresolved centralization and code-quality concerns, treated oracle inputs as trusted by design — a standard audit limitation that left oracle manipulation risk outside audit scope. The absence of a pause or circuit-breaker mechanism allowed an identical replay attack to succeed two hours after the initial exploit.","heading":"Technical Vulnerabilities","severity":"critical","sources":[{"credibility":2,"name":"Balance Stablecoin Collapse: How an Oracle Exploit Broke the Peg - CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/balance-stablecoin-oracle-exploit"},{"credibility":2,"name":"How an Oracle Attack Sent Balance Stablecoin Into a Sudden Collapse - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/oracle-attack-sent-balance-stablecoin-collapse/"},{"credibility":1,"name":"42DAO CertiK Audit - Skynet","type":"research","url":"https://skynet.certik.com/projects/forty-two-dao"},{"credibility":2,"name":"Balance Coin (BLC) Crashes 99% After BTCB Oracle Attack - Bitcoin Foundation News","type":"news_article","url":"https://bitcoinfoundation.org/news/stablecoin-news/blc-depeg-exploit/"}]},{"content":"BLC collapsed from approximately $0.9954 to a low of $0.001209–$0.001358 within hours of the exploit on July 22, 2026, a decline of over 99%. The market capitalization of BLC was erased from an estimated $3.5 million to roughly $12,000. The flood of approximately 4.5 million newly minted unbacked BLC tokens into PancakeSwap V2 liquidity pools destroyed the token's dollar peg by overwhelming available liquidity. Liquidity providers in BLC-denominated pools suffered losses on their pooled assets as the token devalued. KuCoin published coverage of the collapse, and the incident was widely cited by crypto media as an example of oracle-infrastructure risk in DeFi protocols deployed on BNB Chain.","heading":"Market Impact","severity":"critical","sources":[{"credibility":2,"name":"Balance Stablecoin Collapses 99% After Oracle Exploit Drains $912K - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/balance-stablecoin-collapses-99-after-oracle-exploit-drains-912k"},{"credibility":2,"name":"Balance Coin crashes 99% after reported $915K 42DAO exploit - Crypto.news","type":"news_article","url":"https://crypto.news/balance-coin-crashes-99-after-reported-915k-42dao-exploit/"},{"credibility":2,"name":"Another Stablecoin Bites the Dust as BLC Crashes From $1 to Near Worthless - Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/another-stablecoin-bites-the-dust-as-blc-crashes-from-1-to-near-worthless/"}]},{"content":"Community members and analysts debated whether the incident constituted an external exploit or an insider-facilitated rug pull. The absence of any public statement, recovery plan, or post-mortem from 42DAO in the days following the attack fueled speculation. The fact that the same exploit vector succeeded a second time two hours after the initial attack, with no protocol response in the intervening period, raised questions about whether team members were monitoring the protocol in real time. However, no verifiable on-chain evidence of insider wallet activity or fund routing to team-controlled addresses has been publicly established by security firms. SlowMist and PeckShield characterized the incident as a technical exploit — specifically an oracle manipulation attack — rather than a rug pull. The identity of the attacker remains undisclosed in public reporting, and no attacker wallet address has been formally attributed by a security firm in available sources. Without an official post-mortem or law enforcement action, the classification of the event as a pure external exploit versus an insider-assisted attack remains unresolved and is treated as alleged.","heading":"Rug Pull Allegations and Nature of Exploit","severity":"high","sources":[{"credibility":2,"name":"Crypto Hack News: How $915K 42DAO Exploit Crashed BLC by 99% - CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/crypto-hack-news-dollar915k-drained-in-42dao-exploit"},{"credibility":2,"name":"Balance Coin Collapses 99% After Reported $915K Exploit of 42DAO - TFTC","type":"news_article","url":"https://www.tftc.io/balance-coin-42dao-exploit-blc-crash-99-percent"},{"credibility":2,"name":"Balance Coin crashes 99% after reported $915K 42DAO exploit - CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33183695/"}]},{"content":"As of the date of available reporting (July 22–29, 2026), 42DAO had not issued a public statement addressing the exploit, had published no post-mortem analysis, and had announced no recovery or compensation plan for affected users. The protocol's silence following the loss of nearly all user funds is consistent with a pattern observed in several prior BNB Chain DeFi incidents. No law enforcement referral, on-chain fund recovery, white-hat negotiation, or governance vote for restitution was documented in available sources. The 42DAO GitBook documentation and official site remained online but contained no incident disclosures.","heading":"Team Response and Recovery","severity":"critical","sources":[{"credibility":2,"name":"42DAO's BLC Stablecoin Depegs to Near Zero After $912K Oracle Exploit - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/22/42daos-blc-stablecoin-depegs-to-near-zero-after-912k-oracle-exploit/"},{"credibility":2,"name":"Balance Coin crashes 99% after oracle attack drains $912,000 from 42DAO - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/balance-coin-crashes-after-oracle-attack/"}]},{"content":"42DAO engaged CertiK to audit its BLC Minting smart contract. The audit was delivered on January 27, 2025, and identified 13 findings across all severity levels, including a major centralization issue. Notably, all 13 findings were acknowledged by the team but none were resolved or partially resolved. Standard smart-contract audits by firms including CertiK treat oracle data as a trusted input and do not model adversarial oracle manipulation as an in-scope threat vector, which explains why the core vulnerability exploited on July 22, 2026, was not flagged. The centralization finding in the CertiK report — the single major-severity issue — is relevant context: protocols with centralized upgrade or admin keys present additional risk if team keys are compromised or misused. The CertiK audit page is publicly accessible at skynet.certik.com/projects/forty-two-dao.","heading":"Audit History and Security Posture","severity":"high","sources":[{"credibility":1,"name":"42DAO Audit Page - CertiK Skynet","type":"research","url":"https://skynet.certik.com/projects/forty-two-dao"},{"credibility":2,"name":"42DAO Audit Documentation - GitBook","type":"official","url":"https://42dao.gitbook.io/42dao/governance/audit"},{"credibility":2,"name":"Balance Coin (BLC) Crashes 99% After BTCB Oracle Attack - Bitcoin Foundation News","type":"news_article","url":"https://bitcoinfoundation.org/news/stablecoin-news/blc-depeg-exploit/"}]}],"sources_used":[{"credibility":2,"name":"42DAO's BLC Stablecoin Depegs to Near Zero After $912K Oracle Exploit - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/22/42daos-blc-stablecoin-depegs-to-near-zero-after-912k-oracle-exploit/"},{"credibility":2,"name":"Balance Coin crashes 99% after oracle attack drains $912,000 from 42DAO - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/balance-coin-crashes-after-oracle-attack/"},{"credibility":2,"name":"Balance Coin (BLC) Plummets 99% Following $915K Oracle Exploit on BNB Chain - Blockonomi","type":"news_article","url":"https://blockonomi.com/balance-coin-blc-plummets-99-following-915k-oracle-exploit-on-bnb-chain"},{"credibility":2,"name":"42DAO Oracle Exploit Crashes Balance Coin (BLC) 99% After $912K DeFi Hack - CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/162be-42dao-oracle-exploit-crashes-balance-coin-blc-99-after-912k-defi-hack"},{"credibility":2,"name":"Balance Coin Crashes 99% After $915K 42DAO Exploit - LiveBitcoinNews","type":"news_article","url":"https://www.livebitcoinnews.com/balance-coin-crashes-99-after-915k-42dao-exploit/"},{"credibility":2,"name":"Balance Coin Collapses 99% After Reported $915K Exploit of 42DAO - TFTC","type":"news_article","url":"https://www.tftc.io/balance-coin-42dao-exploit-blc-crash-99-percent"},{"credibility":2,"name":"Balance Stablecoin Collapses 99% After Oracle Exploit Drains $912K - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/balance-stablecoin-collapses-99-after-oracle-exploit-drains-912k"},{"credibility":2,"name":"How an Oracle Attack Sent Balance Stablecoin Into a Sudden Collapse - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/oracle-attack-sent-balance-stablecoin-collapse/"},{"credibility":2,"name":"Balance Coin (BLC) Crashes 99% After BTCB Oracle Attack - Bitcoin Foundation News","type":"news_article","url":"https://bitcoinfoundation.org/news/stablecoin-news/blc-depeg-exploit/"},{"credibility":2,"name":"Balance Coin crashes 99% after reported $915K 42DAO exploit - Crypto.news","type":"news_article","url":"https://crypto.news/balance-coin-crashes-99-after-reported-915k-42dao-exploit/"},{"credibility":2,"name":"Another Stablecoin Bites the Dust as BLC Crashes From $1 to Near Worthless - Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/another-stablecoin-bites-the-dust-as-blc-crashes-from-1-to-near-worthless/"},{"credibility":2,"name":"Balance Stablecoin Collapse: How an Oracle Exploit Broke the Peg - CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/balance-stablecoin-oracle-exploit"},{"credibility":2,"name":"Crypto Hack News: How $915K 42DAO Exploit Crashed BLC by 99% - CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/crypto-hack-news-dollar915k-drained-in-42dao-exploit"},{"credibility":2,"name":"Balance Coin Drops 99% As Reported $915K 42DAO Exploit Drains Liquidity - TronWeekly","type":"news_article","url":"https://www.tronweekly.com/balance-coin-drops-99-as-reported-915k-42dao/"},{"credibility":1,"name":"42DAO CertiK Audit - Skynet","type":"research","url":"https://skynet.certik.com/projects/forty-two-dao"},{"credibility":2,"name":"42DAO Audit Documentation - GitBook","type":"official","url":"https://42dao.gitbook.io/42dao/governance/audit"},{"credibility":2,"name":"Intro to 42DAO - GitBook","type":"official","url":"https://42dao.gitbook.io/42dao/42dao/intro-to-42dao"},{"credibility":1,"name":"42DAO: BLC Token on BscScan","type":"on_chain","url":"https://bscscan.com/address/0x5343b4586a3f2a3365df92ee705c3bf446c54668"},{"credibility":2,"name":"Balance Coin crashes 99% after reported $915K 42DAO exploit - CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33183695/"}],"summary":"Balance Coin (BLC) is a USD-pegged stablecoin issued by the Balance Protocol, governed by 42DAO on BNB Chain. On July 22, 2026, an oracle manipulation exploit targeting the protocol's unprotected Spotter and GemJoin modules drained approximately $912,000–$915,000, causing BLC to collapse more than 99% from its $1 peg. The 42DAO team issued no public statement or recovery plan in the aftermath, and the exploit was executed twice within two hours with no circuit breaker triggering between incidents.","timeline":[{"date":"2025-01-27","event":"CertiK delivers audit of the 42DAO BLC Minting smart contract, identifying 13 findings (0 critical, 1 major centralization risk). All findings acknowledged by team; none resolved.","source":"CertiK Skynet - 42DAO Project Page","source_url":"https://skynet.certik.com/projects/forty-two-dao"},{"date":"2026-07-22","event":"Attacker exploits 42DAO's Median Oracle on BNB Chain by injecting an artificially low BTCB price via the Spotter poke function. Dog liquidation module triggers mass vault liquidations. Attacker mints approximately 4.5 million unbacked BLC tokens from a null address via GemJoin and swaps them for BSC-USD and BTCB on PancakeSwap V2. Approximately $912,000–$915,000 is drained. BLC price collapses from ~$0.9954 to ~$0.001358 (over 99% decline).","source":"CryptoTimes / PeckShield / SlowMist / TenArmor","source_url":"https://www.cryptotimes.io/2026/07/22/42daos-blc-stablecoin-depegs-to-near-zero-after-912k-oracle-exploit/"},{"date":"2026-07-22","event":"Approximately two hours after the initial exploit, an identical replay transaction mints an additional 5,900 BLC from a null address and drains further liquidity from PancakeSwap V2. No circuit breaker or pause mechanism activated between the two attacks.","source":"TFTC / Blockonomi / Crypto.news","source_url":"https://www.tftc.io/balance-coin-42dao-exploit-blc-crash-99-percent"},{"date":"2026-07-22","event":"PeckShield publicly reports the exploit, estimating losses at $915,000. TenArmor flags suspicious GemJoin transactions on BNB Chain. SlowMist publishes analysis attributing root cause to the unprotected Median Oracle and absent Spotter safeguards.","source":"Blockonomi / CryptoRank / Cryptopolitan","source_url":"https://blockonomi.com/balance-coin-blc-plummets-99-following-915k-oracle-exploit-on-bnb-chain"},{"date":"2026-07-29","event":"No public statement, post-mortem, or recovery plan from 42DAO has been published. The incident remains unresolved with no team communication recorded in available reporting.","source":"Multiple news sources confirming team silence","source_url":"https://www.cryptopolitan.com/balance-coin-crashes-after-oracle-attack/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6c322bce-b68e-41a8-9687-68f7c59d09f8copy