42DAO — Median Oracle BTCB price manipulation (Balance Coin depeg)

Timeline: On July 22, 2026, an attacker exploited the 42DAO algorithmic stablecoin protocol (a MakerDAO fork on BNB Chain) via oracle manipulation, draining approximately $915K (SlowMist) / $912K (DeFiLlama). In attack 1, the attacker received 18,232 BLC tokens (likely via a preparatory arbitrage step) and sold them across multiple PancakeSwap V2 transactions. In attack 2 (exploit tx 0x3b26b3cb..., block 111367143), the attacker minted 5,889.99 BLC from the null address via a vulnerability in the liquidation path triggered by an artificially low BTCB oracle price submitted through the Median Oracle Spotter poke and Dog bark functions. Because the Spotter lacked price deviation checks, max drawdown limits, and minimum price protections, the manipulated BTCB price triggered forced liquidations of vaults that were in reality fully collateralized. The attacker extracted 2.005 BTCB (~$130K) and ~122K BSC-USD in a single transaction. Balance Coin (BLC), the protocol's $1-pegged stablecoin, depegged 99.75% from ~$0.9954 to a low of ~$0.001209. The protocol was left with bad debt and 42DAO issued no public statement or compensation plan as of July 28, 2026.