A 'stablecoin' collapsed 99% in one transaction — a beginner's guide to oracles

A little-known token called Balance Coin, which was designed to hold a steady value of one U.S. dollar, crashed more than 99% on Wednesday to about $0.0014 after an attacker exploited a flaw in the system behind it. The attacker walked away with roughly $912,000 in a single transaction. The story is a useful lesson in two ideas beginners run into a lot: "algorithmic stablecoins" and "oracles."

First, the setup. Balance Coin was an algorithmic stablecoin — a coin that tries to stay near $1 not because a company holds real dollars for each one, but through rules written in software. In this system, users locked up bitcoin-based collateral to create the coin, and if the value of that collateral fell too far, the software would automatically "liquidate" it — sell it off to keep the system solvent.

To know the value of the collateral, the software needed to know the price of bitcoin. It got that price from an "oracle." An oracle is simply the bridge that feeds outside information — like a market price — into a blockchain program, which otherwise has no way of knowing what is happening in the real world. The whole system trusts the oracle to tell the truth.

That trust was the weak point. According to security firm SlowMist, the attacker fed the system an abnormally low bitcoin price through the oracle. The lending contract accepted that fake price without checking it against a sane range and without any delay, then instantly liquidated vaults that should have been perfectly safe. The attacker scooped up the collateral cheaply and swapped it for a profit. The token's dollar peg never recovered.

This is not the first time a bad price feed has drained a project, and it fits a pattern of DeFi exploits this year that target the logic of smart contracts rather than breaking any cryptography. When a program blindly trusts one number from one source, whoever can fake that number can often take the money.

The takeaway for newcomers: the word "stablecoin" is not a guarantee. A coin backed one-to-one by audited cash reserves is a very different thing from an algorithmic coin held together by code and a single price feed. Before trusting any "stable" token — especially a small, high-yield one you have never heard of — ask what actually backs it, and what happens if one part of the machine gets fed a wrong number.