TL;DR:
During the first seven months of 2026, attacks targeting critical third-party infrastructure in the DeFi ecosystem caused cumulative losses of over $630 million. On Wednesday, July 22, an algorithmic stablecoin collapsed by more than 99% after experiencing price oracle manipulation.
The attacker injected false information regarding the price of Bitcoin into the Balance Coin protocol to drain approximately $912,000 in assets. The manipulation triggered automatic liquidations of collateral positions that were healthy prior to the incident.
In July 2026, the Ostium protocol suffered the extraction of $23.75 million through the submission of adulterated price reports with authorized signatures. Preliminary analysis of the report suggests that the oracle signer’s credentials were compromised by third parties.
For its part, Bonzo Finance lost $9 million during the seventh month of the year due to a verification flaw in an external oracle contract. The vulnerability allowed overvalued collateral to be used to withdraw liquid funds from the protocol.
The most severe case reported was that of KelpDAO, where attackers stole $292 million by compromising external RPC nodes. The breach allowed the validation of false cross-chain bridge messages without triggering any independent verification alerts.
In April 2026, Drift Protocol lost $285 million after malicious actors assigned artificial prices to worthless tokens. Documentation of the case indicates that the attackers used an oracle under their control to back the operation.
Other platforms suffered considerable impacts early in the year from price manipulation. YieldBlox recorded $10.2 million in bad debt in February 2026, while Makina Finance lost $4.1 million in January 2026 following a flash loan attack.
Blockchain cybersecurity firms plan to publish a detailed report featuring new verification frameworks for oracles by the end of the third quarter of 2026.
