DeFi Price-Manipulation Exploit Wave — Record 32 Attacks in 2026
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2dYDPn…mp2xSummary
In 2026, DeFi lending protocols suffered a record 32 price-manipulation exploits through August, nearly tripling the prior annual record of 12 set in 2025, according to blockchain intelligence firm TRM Labs. The attacks follow a repeatable template: inflate a low-liquidity collateral token via flash loan or fraudulent oracle update, post the inflated token as collateral, borrow hard assets, and exit before liquidation. Total DeFi losses across all attack vectors reached approximately $1.3 billion in the first eight months of 2026, with price manipulation representing one in eight of all crypto hacks tracked — up from one in seventeen in 2022.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(11 events)
31 January 2026
Step Finance confirms $27.3 million treasury theft, logged as one of the earliest significant DeFi exploits of the year.
CCN1 April 2026
Drift Protocol loses approximately $285 million in a social-engineering and admin-key-compromise incident attributed by Mandiant, CrowdStrike, and Elliptic to Lazarus Group's TraderTraitor subunit.
AltFins18 April 2026
KelpDAO loses approximately $292 million via a compromised LayerZero verifier, also attributed to Lazarus Group.
AltFins1 April 2026
Rhea Finance on NEAR Protocol exploited for approximately $7.6 million via synthetic-token oracle manipulation. Approximately $3.2 million USDT subsequently frozen.
Yahoo Finance6 July 2026
BonkDAO treasury drained of approximately $20 million in BONK tokens after an attacker spends roughly $4.4 million to acquire enough governance voting power to pass a malicious proposal uncontested.
CoinDesk11 July 2026
Bonzo Lend on Hedera loses $9.05 million after attacker exploits a zero-signature verification flaw in the Supra oracle to post a fraudulent SAUCE price, inflating it by approximately 12 orders of magnitude.
CoinDesk24 August 2026
Term Finance loses approximately $8.5 million after an attacker spends roughly $951 to acquire 90.66% of voting power in a sparsely held governance pool and passes a vault-drain proposal, bypassing the timelock.
CoinDesk27 August 2026
Moonwell on Base loses approximately $8.7 million after attacker inflates MAMO token price roughly 8x and borrows cbBTC, USDC, wstETH, and ETH against the inflated collateral.
The Crypto Times30 August 2026
Tectonic on Cronos exploited for approximately $75 million after attacker inflates TONIC governance token price approximately 100x within 20 minutes and borrows against inflated collateral. Cronos halts block production; validators roll back approximately $68.7 million. Roughly $6 million already bridged to Ethereum is not recovered.
TRM Labs / CoinDesk6 September 2026
The Cryptonomist publishes analysis of the record 32 price-manipulation exploits in 2026.
The Cryptonomist1 September 2026
Crypto.news publishes analysis of $1.3 billion in total DeFi losses through eight months of 2026, identifying price manipulation as a primary recurring vector.
Crypto.newsDecision Log
- hash: 31VvRb1kwrh4tYgXC4qBLxnbVtapJAgw6V7AtU1k8ZvU
This investigation is cryptographically anchored to the Solana blockchain (1 event). 21 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/24/2026, 12:17:40 PM
last updated: 9/24/2026, 4:22:31 PM
avoid.net — verified advice for a post-truth world