What happened
On July 21, 2026, 42DAO's Maker-style BLC system on BNB Chain suffered an oracle-driven liquidation exploit. An abnormal BTCB price caused unsafe liquidations and approximately $912,000–$915,000 of losses.
The liquidation system lacked robust oracle deviation, maximum-drawdown, and minimum-price protections, and did not impose a meaningful liquidation delay or secondary validation. A single abnormal BTCB oracle update could therefore trigger immediate liquidations at an invalid price.
How it happened
The attacker submitted an abnormal BTCB price through the Median Oracle Spotter and triggered the Dog liquidation path. The manipulated price caused collateral to be liquidated and BLC to be minted from the null address before the extracted value was moved out.
Protocol details
Evidence
- analysis 0xposed: 42DAO median-oracle BTCB manipulation 0xposed.io
- analysis DeFiLlama defillama.com
- analysis Delta Incident Archive: 42DAO / Balance Coin oracle liquidation attack deltacapitalhk.com
- analysis Softstack: July 2026 Protocol Recap softstack.io
- analysis Smart Contract Hacking: 42DAO Hack smartcontractshacking.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
