Rising Price Manipulation Attacks Increasingly Hurt Crypto Traders and Lenders

Blockchain intelligence firm TRM Labs has recorded 32 price-manipulation exploits so far in 2026, surpassing the total for all of 2025 and marking the third consecutive year of growth in this specific attack vector. The malicious schemes, which artificially inflate the price of illiquid crypto assets before using them as collateral to drain lending protocols, now account for roughly one in eight hacks - up from one in 17 in 2022. Price Manipulation Exploits Outpace Previous Years as Lending Protocols Become Prime Targets The new data from TRM Labs reveals a sharp acceleration in what researchers describe as an increasingly popular and repeatable form of attack. Last year, only 12 such cases were recorded, meaning 2026 has already seen more than double that figure with months still left in the year. While the sheer number of these exploits has risen, the share of stolen value has remained relatively flat, suggesting that attackers have found ways to execute their schemes with less capital and greater frequency. A key enabler of this trend is the widespread availability of flash loans, which allow attackers to borrow large sums of capital without collateral, provided the loan is repaid within the same transaction block. This makes the capital required to artificially pump a token's price easily accessible to malicious actors. “An attacker who can convince a protocol that a near-worthless asset is valuable never has to touch its code. All it takes is a token with a thin market and an oracle that prices it off that market,” TRM Labs said. Anatomy of an Attack: Thin Markets and Oracle Vulnerabilities The mechanism behind these exploits follows a predictable pattern. An attacker artificially pumps the price of an illiquid crypto asset, then deposits it as collateral to borrow other, more established assets from a lending protocol. Once the inflated price crashes back to its real market value, the attacker simply abandons the now-worthless collateral and keeps the borrowed funds without any intention of repaying the debt. The vulnerability lies in two interconnected weak points: the easily manipulated price of tokens with thin trading volumes, and oracles - the software programs that supply price data to protocols. When an oracle prices a collateral asset based on a shallow, illiquid market, it becomes trivial for an attacker to distort the price feed. Lending protocols rely on these oracles to determine how much a user can borrow, making them a critical point of failure. Tectonic Exploit Results in $70 Million Loss Before Chain Rollback The most recent and one of the largest attacks occurred just days ago when the money market protocol Tectonic lost over $70 million. According to TRM Labs, the attacker inflated the price of TONIC, the protocol's native token, by an astonishing 100x in around 20 minutes. The attacker then used the artificially inflated token as collateral to borrow substantial assets from the protocol. However, the Cronos network, the layer one (L1) blockchain that powers Tectonic, managed to intervene. The network rolled back the chain to reverse the fraudulent transaction, leaving the attacker with “only” approximately $6 million worth of assets. This rollback represents a notable defensive measure, though most blockchain networks are not designed to be reversed, leaving many protocols without this protection. Moonwell Hit Days Earlier with $8.7 Million Drain Just three days before the Tectonic incident, attackers manipulated MAMO oracle prices to drain approximately $8.7 million in assets from Moonwell, another lending protocol. The rapid succession of these attacks underscores the growing threat faced by the crypto lending sector. Per Defillama data, which lists more than 570 lending protocols, in the past two years, in USD terms, total value locked in these platforms has increased around 56%, to almost $50 billion, while the value of active loans almost doubled, nearing $29 billion. Moreover, the attacks this year have accelerated despite the fact that, in USD terms, this market has experienced a sharp drop from its record highs in October 2025, but has been recovering since August amid the broader crypto asset price rally. Lending Protocol Manipulated Token Stolen Value Chain Response Tectonic TONIC Over $70 million Cronos L1 chain rollback reduced attacker's gains to ~$6 million Moonwell MAMO ~$8.7 million Not specified 30 other incidents Various illiquid tokens Data not fully disclosed Varied by platform Retail Traders Caught in the Crossfire The rise in price manipulation attacks poses a direct threat not only to lending protocols but also to everyday crypto traders. When a token's price suddenly skyrockets due to an orchestrated manipulation, unsuspecting traders may be drawn into the rally, purchasing the asset at inflated prices. These traders effectively become the attacker's exit liquidity. “Therefore, when you’re buying this type of manipulated rally, you’re getting right into a trap, becoming the attacker’s way out, much like buying into a rally in a pump-and-dump scheme,” researchers noted. This dynamic mirrors the mechanics of classic pump-and-dump schemes but with an additional layer of harm - the attacker also drains funds from lending protocols that hold user deposits. The combined effect is that both protocol liquidity providers and individual traders face significant financial losses. The Expansion of the Lending Market and Its Risks The growth in these attacks is directly correlated with the expansion of the crypto asset-backed lending market. While the sector has seen substantial growth in total value locked and active loan volumes, this expansion also creates more opportunities for malicious actors to exploit vulnerabilities in pricing mechanisms and oracle infrastructure. The fact that price manipulation attacks have become cheaper and more repeatable suggests that the barrier to entry for would-be attackers is lowering. Flash loans provide the necessary capital injection, while the proliferation of new, illiquid tokens creates a fertile ground for exploitation. For lending protocols and their users, the increasing frequency of these attacks serves as a stark reminder of the systemic risks inherent in a market that relies heavily on accurate price data. What Happened with the Tectonic Price Manipulation Attack? Tectonic, a money market protocol built on the Cronos network, lost over $70 million after an attacker inflated the price of its TONIC token by 100x in about 20 minutes. The Cronos network responded by rolling back the blockchain, which reduced the attacker's actual gains to roughly $6 million worth of assets. How Do Price Manipulation Attacks on Lending Protocols Work? Attackers artificially inflate the price of an illiquid crypto asset, then deposit it as collateral to borrow more established assets from a lending protocol. When the price crashes back to its real market value, the attacker keeps the borrowed assets and abandons the worthless collateral without repaying the debt. Which Lending Protocols Have Been Affected by These Attacks? TRM Labs has registered at least 32 price-manipulation exploits so far in 2026, with the most notable recent cases involving Tectonic, which lost over $70 million, and Moonwell, which lost about $8.7 million through MAMO oracle price manipulation. What Role Do Oracles Play in Crypto Price Manipulation? Oracles are programs that supply price data to lending protocols to determine collateral values. When an oracle prices a token based on a thin or illiquid market, attackers can easily distort the price feed, tricking the protocol into accepting artificially inflated collateral values. Why Has the Number of Price Manipulation Attacks Grown So Quickly? The availability of flash loans provides easily accessible capital for attackers, while the expansion of the crypto lending market creates more targets. TRM Labs reports these attacks now account for about one in eight hacks, up from one in 17 in 2022, and they have become cheaper and more repeatable.