Decentralized <button class="define-target" id="perps">perpetual futures</button> exchange Ostium was drained of at least $24&nbsp;million after an attacker manipulated its <button class="define-target" id="oracle">oracle</button> system — a system that pulls in off-chain price data. After the attacker apparently gained access to the private key used to sign oracle messages, they were able to submit future-dated oracle reports that tricked the system into thinking trades were profitable.<p>The attacker siphoned at least $24&nbsp;million USDC from the protocol, which they quickly swapped into ETH and laundered via Tornado Cash.</p>

"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack"

Ostium exploit

Ostium loses at least $24&nbsp;million to oracle exploit

The Hedera-based decentralized lending platform Bozno Lend was exploited for just over $9&nbsp;million after an attacker took advantage of a flaw in the project's <button class="define-target" id="oracle">oracle</button> system. The attacker was able to deposit tokens worth only a few dollars, then manipulate the project's oracle to reflect a dramatically higher price. They then borrowed $6.63&nbsp;million in USDC and 34.5&nbsp;million <button class="define-target" id="wrapped-token">wrapped</button> HBAR (~$2.4&nbsp;million).<p>Bonzo has announced they will reimburse users affected by the exploit, with support from the Hedera Foundation.</p>

"Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price update"

Bonzo Lend exploit

Bonzo Lend exploited for $9&nbsp;million in oracle attack

Summer Finance, a defi platform that provides "institutional defi vault infrastructure", was exploited for $6&nbsp;million in an apparent <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker used a flash loan to deposit $64.8&nbsp;million and then withdraw $70.9&nbsp;million, taking advantage of a price manipulation bug that allowed them to withdraw more than they deposited.<p>Shortly after the exploit, Summer Finance announced it had "no viable path forward other than to wind down operations". They added, "a meaningful portion of the team's own capital was held in the affected vaults, removing the runway we needed to rebuild."</p>

"Lazy Summer USDC Vault Exploit Post-Mortem: What Happened and What Comes Next"

"Sunsetting Summer.fi and the Labs Company"

Summer Finance exploit

Summer Finance exploited for $6&nbsp;million, shuts down

The Solana deployment of the Across <button class="define-target" id="bridge">bridge</button> was hacked for around $3.35&nbsp;million. According to Across, the stolen funds belonged to Risk Labs, the foundation supporting the project, rather than users of the bridge.

Across Protocol exploit

Across Protocol exploited for $3.35&nbsp;million

The Allbridge blockchain <button class="define-target" id="bridge">bridge</button> was exploited for $1.66&nbsp;million in a <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker took advantage of a flaw in the project's logic that reprices assets against one another, after discovering that the same would happen even when borrowing an asset against collateral denominated in the same token. They were able to manipulate the project's internal pricing logic so that the asset's actual price diverged away from reality, pocketing $1.66&nbsp;million in proceeds.

Event	Date	Amount More info
Ostium exploit	July 15, 2026	$24,000,000
Bonzo Lend exploit	July 10, 2026	$9,050,000
Summer Finance exploit	July 6, 2026	$6,040,000
Across Protocol exploit	July 17, 2026	$3,350,000
Allbridge exploit	July 19, 2026	$1,650,000