Two separate exploits within the decentralized finance (DeFi) sector have exposed critical vulnerabilities in cross-chain bridges and price oracle mechanisms, leading to multi-million-dollar losses. On July 26, 2026, VerusCoin suffered a $7.5 million loss due to a flaw in its Ethereum bridge, while three days earlier, the algorithmic stablecoin Balance Coin (BLC) collapsed to near-zero after an oracle manipulation attack wiped out $3.5 million in market capitalization and drained $912,000 from its governance entity, 42DAO.
Security firm SlowMist confirmed the VerusCoin exploit, noting that the attacker leveraged a missing validation check in the bridge’s protocol to release tokens without proper backing. The incident underscores the persistent risks in cross-chain interoperability, where a single compromised component can drain substantial value. VerusCoin’s price remained static at the time, but the breach fuels broader investor anxiety over bridge security.
The Balance Coin collapse, analyzed by SlowMist and PeckShield, demonstrates a textbook oracle exploit. The attacker manipulated the protocol’s Bitcoin price oracle on BNB Chain, feeding an anomalously low price of BTCB. The protocol’s Spotter module accepted this price without deviation checks, and the Dog liquidation module executed forced liquidations—all within a single transaction. Critically, the protocol lacked an Oracle Security Module (OSM) or time‑delay, safeguards present in MakerDAO that could have prevented the instant propagation of the fake price. The attacker minted 4.5 million unbacked BLC tokens and drained liquidity on PancakeSwap V2, causing the token’s value to drop below $0.0014.
These incidents follow a pattern of oracle and bridge exploits in 2026, including losses at Ostium ($18 million) and Summer.fi ($6 million). The recurrence of such attacks highlights a failure to adopt standard security measures—multiple oracle sources, deviation thresholds, delay mechanisms, and independent liquidation checks—despite their established effectiveness. Governance entities like 42DAO also face scrutiny for deploying production code without these basic protections, signaling a systemic issue in DeFi development and oversight.
