Audit log

Every state-changing event for DeFi Price-Manipulation Exploit Wave — Record 32 Attacks in 2026: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-24 12:21:50Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 450,027,509

   sig

   2dYDPnjhYMPo…yQfjmp2xcopyexplorer ↗

   hash

   31VvRb1kwrh4…tU1k8ZvUcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (27142 B) ▸

   {"actor":"system:backfill","investigation_id":"26a30bbc-ac0b-405d-a0e0-00f55a3cf1f4","kind":"publish","page_slug":"defi-price-manipulation-exploit-wave-record-32-attacks-in-2026","published_at":"2026-09-24T12:21:50.471Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DeFi Price-Manipulation Exploit Wave — Record 32 Attacks in 2026","sections":[{"content":"TRM Labs reported in late August 2026 that 32 separate price-manipulation attacks had struck DeFi lending protocols year-to-date, the highest count the firm has recorded in any single year. The previous annual record was 12 incidents in 2025. Crypto Briefing and CryptoRank both corroborated the TRM Labs figure, citing the firm's published analysis alongside a broader count of 207 total crypto security incidents in the first half of 2026 that generated $972 million in aggregate losses. KuCoin's research blog and The Cryptonomist each published independent analyses in September 2026 reaching the same 32-attack figure. The scale of target opportunity has grown substantially: total value locked in DeFi lending protocols approached $48.8 billion by mid-2026, with active loans nearing $29 billion across more than 570 protocols, according to KuCoin's analysis.","heading":"Threat Overview","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Number of Price-Manipulation Attacks Hits All-Time High as USD 75 Million Is Stolen From Tectonic","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"Crypto Briefing: TRM Labs tracks record high price manipulation exploits in 2026, 207 total hacks","type":"news_article","url":"https://cryptobriefing.com/trm-labs-record-price-manipulation-exploits-2026/"},{"credibility":2,"name":"KuCoin: DeFi Lending Faces a Price Manipulation Crisis as 32 Exploits Hit in 2026","type":"research","url":"https://www.kucoin.com/blog/defi-lending-price-manipulation-exploits-2026"},{"credibility":2,"name":"The Cryptonomist: DeFi Price-Manipulation Exploits Surge To Record High In 2026","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/06/defi-price-manipulation-exploits/"},{"credibility":2,"name":"CryptoRank: Oracle Price Manipulation Drives Record 32 DeFi Attacks This Year, TRM Labs Reports","type":"news_article","url":"https://cryptorank.io/news/feed/ff74a-oracle-price-manipulation-record-defi-attacks-trm-labs"}]},{"content":"According to TRM Labs and multiple secondary analyses, the dominant attack pattern is consistent across incidents: an attacker identifies a DeFi lending protocol that accepts a low-liquidity token as collateral. Using a flash loan — which requires nearly no upfront capital and costs only gas fees if the exploit fails — the attacker temporarily inflates the token's spot price on a thin on-chain market. The inflated token is then posted as collateral to borrow hard assets such as ETH, USDC, or wrapped BTC. Once the borrowed funds are secured, the price reverts and the collateral becomes worthless, leaving the protocol with irrecoverable bad debt. KuCoin's analysis notes that the economic asymmetry is severe: a failed exploit costs only gas fees, while a successful one can yield tens of millions. A variant documented in the Bonzo Lend incident (July 2026) involved submitting a fraudulent price update directly to a third-party oracle's on-chain verifier rather than manipulating an underlying liquidity pool, suggesting attackers are targeting the oracle infrastructure layer as an alternative entry point. Rhea Finance (April 2026) demonstrated a further variant in which the attacker created synthetic tokens, seeded minimal liquidity, and manipulated the resulting price feed to establish fraudulent collateral value.","heading":"Core Attack Pattern","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Price-Manipulation All-Time High Analysis","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"KuCoin: DeFi Lending Price Manipulation Crisis","type":"research","url":"https://www.kucoin.com/blog/defi-lending-price-manipulation-exploits-2026"},{"credibility":1,"name":"CoinDesk: Bonzo Lend $9 Million Oracle Exploit","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera"},{"credibility":2,"name":"Halborn: Explained — The Rhea Finance Hack (April 2026)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"}]},{"content":"The most financially significant single price-manipulation incident in 2026 was the Tectonic exploit on August 30, 2026 on the Cronos blockchain. An attacker inflated the price of Tectonic's governance token TONIC by approximately 100x within roughly 20 minutes, then borrowed an estimated $75 million against the inflated collateral. TONIC had recorded only approximately $305,931 in trading volume in the preceding seven days, making the borrowed sum approximately 245 times that weekly volume. CoinDesk and The Crypto Times each reported that Cronos halted block production at 14:32:47 UTC (block 90907150); validators then rolled back the chain to a pre-exploit state, reversing approximately $68.7 million. Roughly $6 million that had already been bridged to Ethereum prior to the halt was not recovered. TRM Labs noted this is the third-largest price-manipulation exploit on record, following Cetus (May 2025) and Mango Markets (October 2022). On August 27, 2026, Moonwell, a lending protocol on Ethereum layer-2 Base, suffered an approximately $8.7 million loss when an attacker inflated the price of the thinly traded MAMO token from roughly $0.0105 to $0.088 (approximately 8x) and borrowed cbBTC, USDC, wstETH, and ETH against the inflated collateral. Moonwell imposed emergency borrow caps following the incident. Crypto Times reported this was Moonwell's third security incident in 2026. On July 11, 2026, Bonzo Lend on the Hedera network lost approximately $9.05 million after an attacker submitted a fraudulent price update to the Supra oracle system, exploiting a zero-signature verification failure. The attacker deposited approximately 250 SAUCE tokens as collateral and extracted roughly 6.63 million USDC and 34.5 million wrapped HBAR. CoinDesk reported Bonzo's TVL fell 77% within 24 hours, and Hedera's broader TVL dropped nearly 40%. On July 6, 2026, BonkDAO lost approximately $20 million in BONK tokens via a governance attack: an attacker spent roughly $4.4 million to acquire just over 1% of BONK's supply, meeting the quorum threshold in a low-turnout vote, and passed a malicious treasury-drain proposal. CoinDesk and The Record (Recorded Future News) both reported the incident. No smart contract code was broken; the governance mechanism operated as designed. In April 2026, Rhea Finance on the NEAR Protocol lost approximately $7.6 million after an attacker created synthetic tokens, seeded minimal liquidity, and manipulated the resulting oracle feed to borrow real assets. Yahoo Finance and KuCoin News each reported the incident; approximately $3.2 million USDT was subsequently frozen. The Term Finance governance exploit of August 24, 2026 is categorized by most sources as a governance attack rather than a direct price-manipulation exploit: an attacker spent approximately $951 to acquire 0.4852 tmvETH, securing 90.66% of all existing governance voting power in a sparsely held pool, and passed a proposal draining approximately $8.5 million (2,843 ETH and 1.68 million USDC) from Term's Meta Vaults. CoinDesk confirmed the figure. Term Labs permanently shut down Meta Vault deposits following the incident.","heading":"Notable Incidents","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: Cronos Halts Blockchain After $75 Million Tectonic Exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic"},{"credibility":2,"name":"The Crypto Times: Cronos Halts Entire Blockchain After $75M Tectonic Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/cronos-halts-entire-blockchain-after-75m-tectonic-exploit-only-6m-escapes/"},{"credibility":2,"name":"TRM Labs: Tectonic Price-Manipulation Analysis","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"The Crypto Times: Moonwell Loses $8.7M After MAMO Price Manipulation","type":"news_article","url":"https://www.cryptotimes.io/2026/08/27/moonwell-loses-nearly-8-7m-in-base-exploit-after-mamo-price-manipulation/"},{"credibility":2,"name":"Cryptopolitan: Attackers Hit Moonwell for Almost $9M in Price Manipulation Exploit","type":"news_article","url":"https://www.cryptopolitan.com/moonwell-price-manipulation-exploit/"},{"credibility":1,"name":"CoinDesk: Bonzo Lend $9 Million Oracle Exploit Rattles Hedera","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera"},{"credibility":2,"name":"Bonzo Finance Official Incident Report","type":"official","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit"},{"credibility":1,"name":"CoinDesk: BonkDAO $20 Million Treasury Drain After Malicious Governance Proposal","type":"news_article","url":"https://www.coindesk.com/markets/2026/07/07/bonk-faces-usd20-million-treasury-drain-after-attacker-spends-usd4-million-to-pass-malicious-proposal"},{"credibility":1,"name":"The Record (Recorded Future News): Attackers Vote Themselves $20 Million in BONK","type":"news_article","url":"https://therecord.media/attackers-vote-themselves-20-million-bonk-crypto"},{"credibility":2,"name":"Yahoo Finance: Rhea Finance Loses $7.6 Million in Oracle Exploit","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/near-protocol-defi-hub-rhea-163646371.html"},{"credibility":1,"name":"CoinDesk: Term Finance Loses $8.5 Million After Attacker Buys Voting Power","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/24/ethereum-lending-app-term-finance-loses-usd8-5-million-after-attacker-buys-voting-power"}]},{"content":"Price manipulation is one of several major attack vectors driving DeFi losses in 2026. Crypto.news reported total DeFi losses of approximately $1.3 billion through the first eight months of 2026, citing Forbes and CertiK data, with more than 30 individual incidents exceeding $3 million tracked on rekt.news. The dominant loss vector in aggregate terms is compromised credentials and key theft rather than on-chain price manipulation. CertiK attributed approximately 70% of 2026 DeFi losses to key and credential theft, and AltFins noted that key and credential theft accounted for roughly 72% of losses in its tracking through May 2026. North Korea's Lazarus Group (TraderTraitor subunit) was attributed by Mandiant, CrowdStrike, and Elliptic to approximately $575 million in DeFi losses in 2026, primarily through the Drift Protocol ($285 million, April 1) and KelpDAO ($292 million, April 18) incidents. Neither of those incidents involved oracle or price manipulation; both were attributed to compromised admin credentials and social engineering. Price manipulation thus operates as a distinct and growing secondary vector rather than the primary driver of aggregate losses. CertiK's August 2026 report recorded $215 million in total crypto losses for that month alone, with DeFi exploits accounting for $144.6 million.","heading":"Broader 2026 DeFi Loss Context","severity":"high","sources":[{"credibility":2,"name":"Crypto.news: DeFi Has Lost $1.3 Billion to Hacks in 2026 and the Same Attack Keeps Working","type":"news_article","url":"https://crypto.news/defi-hacks-2026-billion-lost-same-attack-keeps-working/"},{"credibility":2,"name":"AltFins: DeFi Hacks 2026 — $840M+ Lost and the Attack That Changed Everything","type":"research","url":"https://altfins.com/blog/defi-hacks-2026/"},{"credibility":2,"name":"The Crypto Times: Crypto Losses Hit $215 Million in August 2026","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/crypto-losses-hit-215-million-in-august-2026-defi-exploits-certik/"},{"credibility":2,"name":"CCN: Biggest DeFi Hacks and Exploits of 2026","type":"news_article","url":"https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/"}]},{"content":"Multiple security researchers identify a consistent set of structural conditions that enable price-manipulation attacks to succeed. KuCoin's analysis identifies low-liquidity collateral with generous borrowing parameters as the foundational precondition. When a protocol accepts tokens with thin on-chain markets as collateral at high loan-to-value ratios, the cost of manipulation is bounded only by the liquidity depth of that market — which in several 2026 incidents was measured in hundreds of thousands of dollars against borrowing capacity in the tens of millions. Governance token structures introduce a second vulnerability surface: protocols that delegate risk-parameter control to governance votes are exposed when governance tokens are sparsely held. The Term Finance and BonkDAO incidents both demonstrated that an attacker willing to spend a few million dollars could acquire decisive voting power when circulating supply is concentrated or voter participation is low. A third vulnerability is oracle centralization or weak signature verification. The Bonzo Lend incident showed that reliance on a single third-party oracle service with a zero-signature verification flaw was sufficient for an attacker to post fraudulent price data without manipulating any underlying liquidity. TRM Labs noted that the median loss per price-manipulation incident in 2026 was approximately $219,000, suggesting that a large number of smaller incidents are occurring alongside high-profile large losses. The low-cost structure of flash loans — where a failed attack costs only gas fees — means that attackers can probe protocols repeatedly at minimal expense.","heading":"Structural Vulnerabilities and Risk Factors","severity":"high","sources":[{"credibility":2,"name":"KuCoin: DeFi Lending Price Manipulation Crisis Analysis","type":"research","url":"https://www.kucoin.com/blog/defi-lending-price-manipulation-exploits-2026"},{"credibility":2,"name":"TRM Labs: Price-Manipulation All-Time High","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":1,"name":"CoinDesk: Term Finance Governance Exploit","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/24/ethereum-lending-app-term-finance-loses-usd8-5-million-after-attacker-buys-voting-power"},{"credibility":2,"name":"Bonzo Finance Incident Report","type":"official","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit"},{"credibility":2,"name":"Halborn: Rhea Finance Hack Explained","type":"research","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"}]},{"content":"Security researchers and protocol teams consistently identify a set of mitigations that have reduced or prevented losses where implemented. Time-weighted average prices (TWAP) smooth oracle readings over a defined window, making single-block or short-duration manipulation significantly more expensive because an attacker must sustain an inflated price for the entire window. Multiple independent oracle sources with deviation limits prevent a single manipulated feed from reaching the protocol unchallenged. Supply caps and borrow caps constrain maximum exposure to any single collateral asset, bounding worst-case losses even when manipulation succeeds. Liquidity circuit breakers that halt borrowing when price movements exceed defined thresholds have been adopted by several protocols in 2026 following incidents. Lower loan-to-value ratios for low-liquidity collateral reduce the leverage available to an attacker per unit of price distortion. Isolated lending markets — where a vulnerable collateral asset's risk is ring-fenced from the broader protocol — prevent contagion across pools. KuCoin's analysis noted that protocols employing TWAP, multiple oracle sources, or liquidity circuit breakers fared notably better in 2026. A Lifecycle-Oriented Detection and Defense Framework published in 2026 on Pith Science proposed detection tooling at the price-feed and transaction-mempool levels as a pre-emptive layer, though this remains a research-stage approach rather than a widely deployed product.","heading":"Defensive Measures","severity":"low","sources":[{"credibility":2,"name":"KuCoin: DeFi Lending Price Manipulation Defenses","type":"research","url":"https://www.kucoin.com/blog/defi-lending-price-manipulation-exploits-2026"},{"credibility":2,"name":"Smart Contract Hacking: Oracle Manipulation Attacks and Defenses (2026)","type":"research","url":"https://smartcontractshacking.com/attacks/oracle-manipulation-attacks"},{"credibility":2,"name":"CertiK: Oracle Wars — The Rise of Price Manipulation Attacks","type":"research","url":"https://www.certik.com/resources/blog/oracle-wars-the-rise-of-price-manipulation-attacks"},{"credibility":2,"name":"Pith Science: Lifecycle-Oriented Detection and Defense Framework for Price Manipulation Attacks in DeFi","type":"research","url":"https://pith.science/paper/2608.15518"}]}],"sources_used":[{"credibility":2,"name":"TRM Labs: Number of Price-Manipulation Attacks Hits All-Time High","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"Crypto.news: DeFi Has Lost $1.3 Billion to Hacks in 2026","type":"news_article","url":"https://crypto.news/defi-hacks-2026-billion-lost-same-attack-keeps-working/"},{"credibility":2,"name":"The Cryptonomist: DeFi Price-Manipulation Exploits Surge To Record High","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/06/defi-price-manipulation-exploits/"},{"credibility":2,"name":"KuCoin: DeFi Lending Faces a Price Manipulation Crisis","type":"research","url":"https://www.kucoin.com/blog/defi-lending-price-manipulation-exploits-2026"},{"credibility":2,"name":"AltFins: DeFi Hacks 2026 — $840M+ Lost","type":"research","url":"https://altfins.com/blog/defi-hacks-2026/"},{"credibility":2,"name":"Crypto Briefing: TRM Labs Tracks Record High Price Manipulation Exploits","type":"news_article","url":"https://cryptobriefing.com/trm-labs-record-price-manipulation-exploits-2026/"},{"credibility":2,"name":"CryptoRank: Oracle Price Manipulation Drives Record 32 DeFi Attacks","type":"news_article","url":"https://cryptorank.io/news/feed/ff74a-oracle-price-manipulation-record-defi-attacks-trm-labs"},{"credibility":1,"name":"CoinDesk: Cronos Halts Blockchain After $75M Tectonic Exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic"},{"credibility":2,"name":"The Crypto Times: Cronos Halts After $75M Tectonic Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/cronos-halts-entire-blockchain-after-75m-tectonic-exploit-only-6m-escapes/"},{"credibility":2,"name":"The Crypto Times: Moonwell Loses $8.7M After MAMO Price Manipulation","type":"news_article","url":"https://www.cryptotimes.io/2026/08/27/moonwell-loses-nearly-8-7m-in-base-exploit-after-mamo-price-manipulation/"},{"credibility":2,"name":"Cryptopolitan: Moonwell Price Manipulation Exploit","type":"news_article","url":"https://www.cryptopolitan.com/moonwell-price-manipulation-exploit/"},{"credibility":1,"name":"CoinDesk: Bonzo Lend $9 Million Oracle Exploit","type":"news_article","url":"https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera"},{"credibility":2,"name":"Bonzo Finance: Official Incident Report","type":"official","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit"},{"credibility":1,"name":"CoinDesk: BonkDAO $20 Million Treasury Drain","type":"news_article","url":"https://www.coindesk.com/markets/2026/07/07/bonk-faces-usd20-million-treasury-drain-after-attacker-spends-usd4-million-to-pass-malicious-proposal"},{"credibility":1,"name":"The Record (Recorded Future News): Attackers Vote Themselves $20 Million in BONK","type":"news_article","url":"https://therecord.media/attackers-vote-themselves-20-million-bonk-crypto"},{"credibility":2,"name":"Yahoo Finance: Rhea Finance Loses $7.6 Million in Oracle Exploit","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/near-protocol-defi-hub-rhea-163646371.html"},{"credibility":2,"name":"Halborn: Explained — The Rhea Finance Hack","type":"research","url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026"},{"credibility":1,"name":"CoinDesk: Term Finance Loses $8.5 Million After Governance Exploit","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/24/ethereum-lending-app-term-finance-loses-usd8-5-million-after-attacker-buys-voting-power"},{"credibility":2,"name":"The Crypto Times: Crypto Losses Hit $215 Million in August 2026","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/crypto-losses-hit-215-million-in-august-2026-defi-exploits-certik/"},{"credibility":2,"name":"CCN: Biggest DeFi Hacks and Exploits of 2026","type":"news_article","url":"https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/"},{"credibility":2,"name":"Smart Contract Hacking: Oracle Manipulation Attacks and Defenses 2026","type":"research","url":"https://smartcontractshacking.com/attacks/oracle-manipulation-attacks"},{"credibility":2,"name":"CertiK: Oracle Wars — The Rise of Price Manipulation Attacks","type":"research","url":"https://www.certik.com/resources/blog/oracle-wars-the-rise-of-price-manipulation-attacks"},{"credibility":2,"name":"Pith Science: Lifecycle-Oriented Detection and Defense Framework","type":"research","url":"https://pith.science/paper/2608.15518"}],"summary":"In 2026, DeFi lending protocols suffered a record 32 price-manipulation exploits through August, nearly tripling the prior annual record of 12 set in 2025, according to blockchain intelligence firm TRM Labs. The attacks follow a repeatable template: inflate a low-liquidity collateral token via flash loan or fraudulent oracle update, post the inflated token as collateral, borrow hard assets, and exit before liquidation. Total DeFi losses across all attack vectors reached approximately $1.3 billion in the first eight months of 2026, with price manipulation representing one in eight of all crypto hacks tracked — up from one in seventeen in 2022.","timeline":[{"date":"2026-01-31","event":"Step Finance confirms $27.3 million treasury theft, logged as one of the earliest significant DeFi exploits of the year.","source":"CCN","source_url":"https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/"},{"date":"2026-04-01","event":"Drift Protocol loses approximately $285 million in a social-engineering and admin-key-compromise incident attributed by Mandiant, CrowdStrike, and Elliptic to Lazarus Group's TraderTraitor subunit.","source":"AltFins","source_url":"https://altfins.com/blog/defi-hacks-2026/"},{"date":"2026-04-18","event":"KelpDAO loses approximately $292 million via a compromised LayerZero verifier, also attributed to Lazarus Group.","source":"AltFins","source_url":"https://altfins.com/blog/defi-hacks-2026/"},{"date":"2026-04-01","event":"Rhea Finance on NEAR Protocol exploited for approximately $7.6 million via synthetic-token oracle manipulation. Approximately $3.2 million USDT subsequently frozen.","source":"Yahoo Finance","source_url":"https://finance.yahoo.com/markets/crypto/articles/near-protocol-defi-hub-rhea-163646371.html"},{"date":"2026-07-06","event":"BonkDAO treasury drained of approximately $20 million in BONK tokens after an attacker spends roughly $4.4 million to acquire enough governance voting power to pass a malicious proposal uncontested.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/07/07/bonk-faces-usd20-million-treasury-drain-after-attacker-spends-usd4-million-to-pass-malicious-proposal"},{"date":"2026-07-11","event":"Bonzo Lend on Hedera loses $9.05 million after attacker exploits a zero-signature verification flaw in the Supra oracle to post a fraudulent SAUCE price, inflating it by approximately 12 orders of magnitude.","source":"CoinDesk","source_url":"https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera"},{"date":"2026-08-24","event":"Term Finance loses approximately $8.5 million after an attacker spends roughly $951 to acquire 90.66% of voting power in a sparsely held governance pool and passes a vault-drain proposal, bypassing the timelock.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/08/24/ethereum-lending-app-term-finance-loses-usd8-5-million-after-attacker-buys-voting-power"},{"date":"2026-08-27","event":"Moonwell on Base loses approximately $8.7 million after attacker inflates MAMO token price roughly 8x and borrows cbBTC, USDC, wstETH, and ETH against the inflated collateral.","source":"The Crypto Times","source_url":"https://www.cryptotimes.io/2026/08/27/moonwell-loses-nearly-8-7m-in-base-exploit-after-mamo-price-manipulation/"},{"date":"2026-08-30","event":"Tectonic on Cronos exploited for approximately $75 million after attacker inflates TONIC governance token price approximately 100x within 20 minutes and borrows against inflated collateral. Cronos halts block production; validators roll back approximately $68.7 million. Roughly $6 million already bridged to Ethereum is not recovered.","source":"TRM Labs / CoinDesk","source_url":"https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic"},{"date":"2026-09-06","event":"The Cryptonomist publishes analysis of the record 32 price-manipulation exploits in 2026.","source":"The Cryptonomist","source_url":"https://en.cryptonomist.ch/2026/09/06/defi-price-manipulation-exploits/"},{"date":"2026-09-01","event":"Crypto.news publishes analysis of $1.3 billion in total DeFi losses through eight months of 2026, identifying price manipulation as a primary recurring vector.","source":"Crypto.news","source_url":"https://crypto.news/defi-hacks-2026-billion-lost-same-attack-keeps-working/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a8c42309-10b3-473d-adf0-294b643bc952copy