TRM Labs Counts 32 Crypto Price-Manipulation Exploits in 2026 as Lending Risks Grow

Why these attacks are becoming more common

TRM Labs said price manipulation now makes up roughly one in eight crypto hacks, compared with one in 17 in 2022. Even so, the share of total stolen value has stayed relatively flat, a sign that these exploits may be getting cheaper and easier to repeat rather than larger in every instance.

The firm pointed to two recurring weak points: tokens with thin trading markets and oracles that derive prices from those markets. In that setup, an attacker may not need to exploit a protocol’s code directly. If a protocol accepts a nearly worthless asset as valuable collateral because its oracle reflects a distorted market price, the attacker can still extract real assets from the system.

TRM Labs also said access to flash loans appears to lower the capital barrier for this strategy, making it easier to execute manipulation without large upfront funds.

Lending growth expands the attack surface

The increase in these exploits is unfolding alongside growth in crypto-backed lending. Data from Defillama cited in the report shows that across more than 570 lending protocols, total value locked has risen about 56% in the past two years to nearly $50 billion, while active loans have almost doubled to around $29 billion.

That means a larger pool of collateral, borrowers and lenders is now exposed to oracle and liquidity failures. The attacks have also accelerated even though the lending market, in U.S. dollar terms, fell sharply from record highs reached in October 2025. The source article says the sector has been recovering since August as broader crypto prices climbed.

Tectonic and Moonwell highlight the damage

One of the largest recent cases involved Tectonic, a money market protocol, which lost more than $70 million after an attacker drove up the price of TONIC. TRM Labs said TONIC was inflated about 100-fold in roughly 20 minutes before it was used in the exploit.

The eventual outcome was partially limited by intervention at the network level. According to the report, Cronos, the layer-1 blockchain behind Tectonic, rolled back the chain, reducing the attacker’s proceeds to about $6 million in assets.

Another incident came three days earlier, when attackers manipulated MAMO oracle prices and drained about $8.7 million from Moonwell, another lending protocol. Together, the cases show how quickly manipulated collateral can translate into direct losses for lending markets.

The losses do not stop with the targeted token

The source article notes that damage from these incidents can reach users who never held the manipulated asset. If a lending pool is left with bad debt after collateral collapses, depositors and lenders may face uncertainty over withdrawals depending on what assets remain in the pool.

Recovery prospects can depend on whether protocol operators are able to freeze addresses, reverse transactions or negotiate with the attacker. But legal recovery is not straightforward either. The article points to the Mango Markets case, where a U.S. judge in May last year vacated fraud and manipulation charges against Avram Eisenberg after prosecutors failed to prove the case should be tried in New York; prosecutors have since appealed.

The report also flags a governance problem in some protocols. In Tectonic’s case, TONIC is the platform’s own governance token and is accepted as collateral by the same system. Risk settings are therefore influenced by participants who may benefit from a rising token price, even though they may also suffer when that price collapses.

What comes next

The core risk identified in the report is unlikely to disappear while lending protocols continue to accept thinly traded tokens and rely on oracle designs that can be swayed by shallow markets. As lending activity grows, the amount of capital exposed to this kind of manipulation can grow with it.

For now, the clearest confirmed trend is the pace of incidents themselves: TRM Labs has already logged 32 price-manipulation exploits in 2026, far above last year’s total, with recent attacks on Tectonic and Moonwell underscoring how quickly inflated collateral can turn into losses for protocols and their users.