Oracle Manipulation attacks in 2026

An attacker seized Ostium's price-feed infrastructure and fed future-dated oracle prices to open and close trades at will, draining a confirmed $23.75 million from the OLP vault on Arbitrum.

An attacker exploited a signature-verification flaw in a third-party Supra oracle to manipulate the SAUCE price and drain about $9 million from Bonzo Lend, Hedera's largest lending protocol.

A flash-loan-funded attacker inflated Edel Finance's internal wGOOGLx exchange rate ~78x, borrowing against phantom tokenized-Google-stock collateral to leave about $403,000 in bad debt.

~$1.78M drained from Moonwell on Base after a newly listed market used a price feed with a decimals mismatch, mis-valuing collateral so attackers borrowed out.

YieldBlox's Stellar lending pool lost $10.2M after a single USTRY-for-USDC sell at 501x market rate defined the Reflector oracle price in a quiet 15-min window.