The incident occurred on July 22, 2026. Attackers minted millions of unbacked $BLC tokens from the protocol and swapped them for USDT and BTCB through PancakeSwap pools, extracting roughly $915,000. PeckShield flagged the exploit involving 42DAO. Balance Coin, an algorithmic stablecoin designed to maintain a $1 peg, plummeted more than 99 percent in value within hours, trading as low as $0.001357. The rapid depeg wiped out substantial value for holders and liquidity providers in the 42DAO ecosystem.
#PeckShieldAlert Balance Coin $BLC has plummeted -99% @42dao_official @42dao_official has been exploited for ~$915K pic.twitter.com/1bdRpMQBs3
— PeckShieldAlert (@PeckShieldAlert) July 22, 2026
Attack Sequence
According to on-chain records, the attackers executed two main transactions that leveraged the protocol’s GemJoin contract on the BLC token (0x5343b458…c54668). They minted large amounts of BLC from a null address before routing the tokens into PancakeSwap V2 pools to drain available liquidity. The extracted funds were converted into stable assets and BTCB, allowing the attackers to cash out significant value quickly.
The exploit adds to a series of recent security incidents on BNB Chain. Earlier this month, attackers drained an estimated $7.3 million from DxSale’s legacy liquidity lockers, underscoring the continued risks posed by vulnerable DeFi infrastructure on the network.
Project Background and Impact
42DAO focuses on over-collateralized stablecoin minting backed by assets such as USDT, BTC, and BCH. The project had earlier publicized smart contract audits, including one by CertiK for its BLC minting contract. This latest breach comes as the protocol was expanding features including staking and cross-chain capabilities. The incident also follows another recent BNB Chain exploit in which TesseraDAO lost approximately $2.5 million after attackers compromised its protocol, triggering a sharp decline in the TSR token. The back-to-back incidents highlight the growing security challenges facing smaller DeFi ecosystems.
🚀HUGE NEWS from 42DAO🚀
We’re thrilled to announce that $BLC has officially surpassed the 10,000,000 mint milestone!🥳
Securely backed by over-collateralization with $USDT, $BTC and $BCH, stability and security are paramount—a testament to the strength and trust in the BLC… pic.twitter.com/qqXS4WOKHF
— 42DAO (@42dao_official) April 9, 2025
The exploit has severely impacted BLC holders and those providing liquidity on PancakeSwap. Related trading pools saw immediate liquidity drainage, further limiting market activity and deepening losses. Broader total value locked figures for 42DAO components were not immediately available. This incident adds to the persistent challenges facing smaller DeFi projects and algorithmic stablecoins. It highlights ongoing risks around minting controls and authorization mechanisms even in protocols that have undergone audits.
The latest attack also reflects a broader trend of infrastructure-level exploits across decentralized finance. Earlier this month, Allbridge Core suffered an estimated $1.65 million exploit targeting its Solana liquidity pool, demonstrating that bridge and liquidity protocols continue to face persistent security threats across multiple blockchain ecosystems. No official statement from the 42DAO team was available at the time of publication. The project is expected to issue updates regarding any mitigation steps, fund recovery efforts, or contract measures. Users are advised to monitor official channels and remain cautious with related assets.
