1 day ago
19
Price manipulation exploits in DeFi have nearly tripled year over year, and the playbook behind them is getting cheaper to run. TRM Labs reported 32 such incidents through August 2026, obliterating the previous annual record of 12 set in 2025.
These attacks now represent roughly one in every eight crypto hacks. Back in 2022, the ratio was one in 17.
Flash loans and thin liquidity: a recipe for exploitation
The mechanics behind most of these exploits follow a familiar template. An attacker uses a flash loan, which is essentially a massive uncollateralized loan that must be repaid within a single blockchain transaction, to temporarily inflate the price of a low-liquidity token. They then use that artificially pumped token as collateral to borrow real assets from a lending protocol before the price snaps back to reality.
TRM Labs attributes the record surge to the proliferation of protocols relying on low-liquidity oracles. The attacks are cheap and repeatable, which explains why the total dollar value stolen hasn’t spiked proportionally to the number of incidents. The median loss per hack in the first half of 2026 sat at approximately $219,000, with 207 total hacking incidents producing $972 million in aggregate losses.
Two attacks, one week, very different outcomes
On August 30, an attacker targeted Tectonic, a lending protocol on the Cronos chain, by inflating the price of its governance token TONIC by roughly 100 times. With that artificially juiced collateral, they borrowed close to $75 million in other assets.
The Cronos chain executed a rollback, essentially rewinding the blockchain to reverse the damage. The attacker still walked away with around $6 million, but the intervention clawed back the vast majority of the stolen funds.
Three days earlier, on August 27, the Moonwell protocol lost approximately $8.7 million through a similar technique. The attacker manipulated the oracle price of the MAMO token, borrowed against the inflated value, and drained funds. No rollback rescued Moonwell’s users.
A growing target on a growing sector
Total value locked across lending protocols now approaches $50 billion, a 56% increase over the past two years. Active loans are nearing $29 billion, spread across more than 570 protocols.
The economics are straightforward. Launching a flash loan costs almost nothing upfront. If the target protocol relies on a price feed that can be temporarily manipulated through a large trade in a low-liquidity pool, the attacker profits. If the exploit fails, the flash loan simply reverts, and the attacker loses only gas fees.
What this means for DeFi participants
Protocols using time-weighted average prices, multiple oracle sources, or liquidity circuit breakers have fared notably better. European regulators under MiCA and US agencies have both signaled increased focus on DeFi protocol security standards.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
English (US) ·