Oracle Manipulation attacks in 2026

A trader moved Hyperliquid's ETH reference price while holding leveraged Papertrade positions, netting about $1.28 million from the platform's shared USDC pool on launch day.

An attacker wash-traded NSTR through a fake pool to pump its price roughly 8,000x, then borrowed about $3.5 million against the inflated collateral on Nostra's Starknet money market.

An attacker inflated Tectonic's TONIC token 100x to borrow ~$74M from the Cronos lending protocol, but a chain rollback limited the permanent loss to ~$6M.

An attacker inflated the price of the illiquid MAMO token to borrow real assets from Moonwell's lending markets on Base, draining about $8.7 million.

An attacker seized Ostium's price-feed infrastructure and fed future-dated oracle prices to open and close trades at will, draining a confirmed $23.75 million from the OLP vault on Arbitrum.

An attacker exploited a signature-verification flaw in a third-party Supra oracle to manipulate the SAUCE price and drain about $9 million from Bonzo Lend, Hedera's largest lending protocol.

A flash-loan-funded attacker inflated Edel Finance's internal wGOOGLx exchange rate ~78x, borrowing against phantom tokenized-Google-stock collateral to leave about $403,000 in bad debt.

~$1.78M drained from Moonwell on Base after a newly listed market used a price feed with a decimals mismatch, mis-valuing collateral so attackers borrowed out.

YieldBlox's Stellar lending pool lost $10.2M after a single USTRY-for-USDC sell at 501x market rate defined the Reflector oracle price in a quiet 15-min window.