← Balance Coin (BLC) Oracle Manipulation / 42DAOreviewed 2026-10-17 · 19 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Balance Coin (BLC) Oracle Manipulation / 42DAO against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #13[unverifiable][awaiting moderator]in section: Protocol Design Failures
“The market capitalization of BLC was erased from an estimated $3.5 million to roughly $12,000.”
reviewerThe market capitalization of BLC was erased from an estimated $3.5 million to roughly $12,000.The $3.5 million pre-crash figure is corroborated, but no source consulted gives the specific $12,000 post-crash figure; it could not be confirmed or contradicted.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #17[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260729131326/https://blockonomi.com/movement-labs-files-for-chapter-11-bankruptcy-after-38m-move-token-scandal/”
reviewerThe Blockonomi article is correctly archived at its cited archive_url.The archive_url stored for this Blockonomi citation is a Wayback Machine snapshot of an unrelated article about Movement Labs' Chapter 11 bankruptcy and the MOVE token, not the Balance Coin/42DAO piece. The primary url field is fine; only the archive companion link is mismatched and should be removed until a correct snapshot of the actual article is captured. - #18[link rot][awaiting moderator]in section: The Oracle Manipulation Exploit
“https://42dao.gitbook.io/42dao/42dao/intro-to-42dao”
reviewerThe '42DAO GitBook documentation and official site remained online' and the specific cited Intro-to-42DAO GitBook page supports the protocol-overview claims.The GitBook page restructured and the cited URL no longer resolves. A working Wayback Machine snapshot from the time of research is already recorded for this exact URL in sources_used and should be substituted as the live citation at the section-source level.Proposed correction (not yet applied)https://web.archive.org/web/20260729131120/https://42dao.gitbook.io/42dao/42dao/intro-to-42dao
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #5[partially supported][awaiting moderator]in section: The Oracle Manipulation Exploit
“The protocol received a CertiK audit delivered on January 27, 2025, covering the BLC Minting smart contract.”
reviewerThe CertiK audit covered 'the BLC Minting smart contract.'The audit date and finding counts are accurate, but describing the audit as covering 'the BLC Minting smart contract' implies a single contract by that name, when the actual audited files are Custodian.sol and Exchange.sol (the name comes from the GitHub repo, not a contract). - #6[partially supported][awaiting moderator]in section 7
“42DAO engaged CertiK to audit its BLC Minting smart contract.”
reviewer42DAO engaged CertiK to audit 'its BLC Minting smart contract.'Same underlying mischaracterization as the Protocol Overview section; grouped under the same defect. - #7[partially supported][awaiting moderator]in the timeline
“CertiK delivers audit of the 42DAO BLC Minting smart contract, identifying 13 findings (0 critical, 1 major centralization risk). All findings acknowledged by team; none resolved.”
reviewerCertiK delivers audit of the 42DAO 'BLC Minting smart contract' on January 27, 2025.Same underlying mischaracterization repeated in the timeline entry; grouped under the same defect as the two section occurrences.
confirmed
13 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: The Oracle Manipulation Exploit
“42DAO is the decentralized autonomous organization governing the Balance Protocol on BNB Chain (BSC).”
reviewer42DAO governs the Balance Protocol on BNB Chain, which issues the USD-pegged stablecoin Balance Coin (BLC).Core structural claim is corroborated by multiple independent listings, though the specific cited GitBook URL for this claim is dead (see separate link_rot finding). - #2[confirmed][no action needed]in section: The Oracle Manipulation Exploit
“Governance rights are held by FTD token holders, who vote on protocol decisions.”
reviewerGovernance rights are held by FTD token holders, and the BCH Ecosystem Fund is a founding member of 42DAO.Independently corroborated via secondary token-listing aggregators since the primary GitBook citation is dead. - #3[confirmed][no action needed]in section: The Oracle Manipulation Exploit
“The BLC token contract is deployed at address 0x5343b4586a3f2a3365df92ee705c3bf446c54668 on BSC.”
reviewerThe BLC token contract is deployed at 0x5343b4586a3f2a3365df92ee705c3bf446c54668 on BSC.BscScan itself returned 403 to the fetch tool, but a third-party on-chain data aggregator confirms the same address as BLC on BSC. - #4[confirmed][no action needed]in section: The Oracle Manipulation Exploit
“The audit identified 13 findings: 0 critical, 1 major (centralization), 4 medium (logical issues), 5 minor (volatile code), and 3 informational (design issues). All 13 findings were acknowledged by the team but none were resolved or partially resolved at the time of the exploit.”
reviewerCertiK delivered an audit on January 27, 2025, identifying 13 findings (0 critical, 1 major, 4 medium, 5 minor, 3 informational), all acknowledged but none resolved.Directly verified against the live CertiK Skynet project page; figures match exactly. - #8[confirmed][no action needed]in section: Unbacked Token Minting and Market Collapse
“On July 22, 2026, an attacker exploited the Balance Protocol's Median Oracle on BNB Chain, draining between $912,000 and $915,000 in a two-stage attack executed approximately two hours apart.”
reviewerOn July 22, 2026, an attacker exploited the Spotter/Dog/GemJoin modules draining $912,000-$915,000 in a two-stage attack roughly two hours apart.Date, loss range, two-stage structure, and timing gap are consistently corroborated across independent outlets. - #9[confirmed][no action needed]in section: Unbacked Token Minting and Market Collapse
“A near-identical second transaction executed roughly two hours later minted an additional 5,900 BLC tokens and drained further liquidity, indicating the absence of any circuit breaker or pause mechanism in the protocol.”
reviewerThe attacker minted approximately 4.5 million BLC from a null address via GemJoin in the first attack, and 5,900 BLC in a near-identical second attack roughly two hours later, with no circuit breaker triggering.Figures and sequencing match two independent outlets' reporting of the same on-chain events. - #10[confirmed][no action needed]in section: Unbacked Token Minting and Market Collapse
“Security firms PeckShield and SlowMist independently identified and analyzed the incident; on-chain activity was also flagged by TenArmor.”
reviewerSecurity firms PeckShield, SlowMist, and TenArmor each played the stated roles (PeckShield loss estimate, SlowMist root-cause analysis, TenArmor flagging on-chain activity).Role attribution for each firm matches independent reporting. - #11[confirmed][no action needed]in section: Market Capitalization Collapse
“Specific absent protections included: no price deviation limits on the Spotter contract; no minimum price floor preventing extreme low values from being written to the VAT; no maximum drawdown limitation; no time-weighted average price (TWAP) feed as a secondary check; and no liquidation delay before the Dog module executed vault liquidations.”
reviewerThe Balance Protocol omitted a MakerDAO-style Oracle Security Module and lacked price deviation limits, a minimum price floor, max drawdown limits, TWAP, and liquidation delay.Technical description of missing safeguards matches the cited reporting closely. - #12[confirmed][no action needed]in section: Protocol Design Failures
“BLC collapsed from approximately $0.9954 to a low of $0.001209–$0.001358 within hours of the exploit on July 22, 2026, a decline of over 99%.”
reviewerBLC collapsed from approximately $0.9954 to a low of $0.001209-$0.001358, a decline of over 99%.The stated price range brackets figures given by two independent outlets. - #14[confirmed][no action needed]in section: Protocol Design Failures
“KuCoin published coverage of the collapse, and the incident was widely cited by crypto media as an example of oracle-infrastructure risk in DeFi protocols deployed on BNB Chain.”
reviewerKuCoin published coverage of the collapse.Directly verified. - #15[confirmed][no action needed]in section: Exploit vs. Rug Pull — Unresolved Question
“SlowMist and PeckShield characterized the incident as a technical exploit — specifically an oracle manipulation attack — rather than a rug pull.”
reviewerSlowMist and PeckShield characterized the incident as a technical oracle manipulation exploit rather than a rug pull, and no attacker wallet has been formally attributed.The section is appropriately hedged ('alleged', 'unresolved') and matches the cautious framing used in the underlying reporting. - #16[confirmed][no action needed]in section: Absence of Official Response
“As of the date of available reporting (July 22–29, 2026), 42DAO had not issued a public statement addressing the exploit, had published no post-mortem analysis, and had announced no recovery or compensation plan for affected users.”
reviewerAs of July 22-29, 2026, 42DAO had issued no public statement, post-mortem, or recovery plan.A fresh search as of October 2026 (roughly three months after the exploit) likewise turned up no official 42DAO statement, post-mortem, or compensation plan, so the claim holds beyond the originally cited window as well, though the page correctly scopes its claim to the July 22-29 reporting window only. - #19[confirmed][no action needed]in section 7
“The CertiK audit page is publicly accessible at skynet.certik.com/projects/forty-two-dao.”
reviewer42DAO engaged CertiK to audit its BLC Minting smart contract, and the audit page is publicly accessible at skynet.certik.com/projects/forty-two-dao.Directly verified; page is live and accessible.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.