Price manipulation attacks targeting crypto lending protocols have accelerated sharply in 2026, with 32 exploits already recorded this year — more than in any previous year, according to blockchain intelligence firm TRM Labs. The trend underscores a growing vulnerability in the crypto-backed lending market, where illiquid tokens and weak oracle pricing create repeatable attack vectors.
How the Attacks Work
The scheme follows a consistent pattern. An attacker artificially inflates the price of an illiquid token, deposits it as collateral in a lending protocol, borrows liquid assets against the inflated valuation, and then the token price collapses. The attacker walks away with the borrowed assets while leaving the protocol holding worthless collateral as bad debt.
TRM Labs researchers summarized the vulnerability: "An attacker who can convince a protocol that a near-worthless asset is valuable never has to touch its code. All it takes is a token with a thin market and an oracle that prices it off that market."
Attack Volume and Frequency
Price manipulation now accounts for roughly one in eight crypto hacks, up from one in 17 in 2022. The number of recorded exploits has grown for three consecutive years, rising from 12 in 2025 to the 32 already logged in 2026. Despite the increase in frequency, the share of total stolen value has remained relatively flat, which TRM Labs suggests indicates these attacks have become cheaper and more repeatable, with capital for execution easily accessible through flash loans.
A Growing Attack Surface
The rise in manipulation coincides with the expansion of the crypto lending market itself. Data from Defillama, which tracks more than 570 lending protocols, shows total value locked in these platforms grew approximately 56% over the past two years to nearly $50 billion, while the value of active loans nearly doubled to almost $29 billion.
Notably, attacks have continued to accelerate this year despite a sharp decline in the lending market's USD-denominated value from its October 2025 highs. The market has been recovering since August amid a broader crypto rally.
Recent Examples
One of the most recent and largest attacks occurred just days before this reporting, when money market protocol Tectonic lost over $70 million after an attacker inflated the price of its governance token, TONIC, by 100x in approximately 20 minutes. The Cronos network, the layer-one blockchain powering Tectonic, managed to roll back the chain, reducing the attacker's effective take to roughly $6 million in assets.
Three days prior, attackers manipulated MAMO oracle prices to drain about $8.7 million from Moonwell, another lending protocol.
Collateral Damage to Innocent Users
Users who do not hold the manipulated token can still suffer losses. When an attack leaves a lending pool with bad debt, other depositors' ability to withdraw funds depends on what assets remain in the pool. Recovery efforts hinge on whether protocol operators can freeze attacker addresses, reverse transactions, or negotiate restitution.
Legal recourse presents its own challenges. In a 2025 case involving a similar attack on Mango Markets, a U.S. judge ruled that the platform had no rules prohibiting manipulation, no one testified that users understood borrowing to reflect an intent to repay, and the protocol itself was permissionless and automatic. The judge vacated fraud and manipulation charges against Avram Eisenberg after prosecutors failed to establish venue in New York. Prosecutors have since appealed.
Governance Conflicts
An additional structural risk involves conflicts of interest within protocols. In the Tectonic case, TONIC serves as both the protocol's governance token and accepted collateral. Risk parameters are set by individuals who benefit from the token's price appreciation, yet also face liquidation risk if they fail to exit quickly when prices collapse.
These dynamics create a market where participants seeking predictable yield on deposited assets face rising exposure to attacks, while the incentive structure for exploiting thin-market tokens continues to grow alongside the lending sector itself.
