Decentralized <button class="define-target" id="perps">perpetual futures</button> exchange Ostium was drained of at least $24&nbsp;million after an attacker manipulated its <button class="define-target" id="oracle">oracle</button> system — a system that pulls in off-chain price data. After the attacker apparently gained access to the private key used to sign oracle messages, they were able to submit future-dated oracle reports that tricked the system into thinking trades were profitable.<p>The attacker siphoned at least $24&nbsp;million USDC from the protocol, which they quickly swapped into ETH and laundered via Tornado Cash.</p>

"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack"

Ostium exploit

Ostium loses at least $24&nbsp;million to oracle exploit

The Hedera-based decentralized lending platform Bozno Lend was exploited for just over $9&nbsp;million after an attacker took advantage of a flaw in the project's <button class="define-target" id="oracle">oracle</button> system. The attacker was able to deposit tokens worth only a few dollars, then manipulate the project's oracle to reflect a dramatically higher price. They then borrowed $6.63&nbsp;million in USDC and 34.5&nbsp;million <button class="define-target" id="wrapped-token">wrapped</button> HBAR (~$2.4&nbsp;million).<p>Bonzo has announced they will reimburse users affected by the exploit, with support from the Hedera Foundation.</p>

"Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price update"

Bonzo Lend exploit

Bonzo Lend exploited for $9&nbsp;million in oracle attack

An attacker exploited the Wanchain <button class="define-target" id="bridge">bridge</button>, stealing 515&nbsp;million NIGHT tokens that had been bridged from Cardano to BNB. The NIGHT token belongs to Midnight, a privacy-focused blockchain linked to Cardano. The stolen tokens were priced at $9&nbsp;million to $10&nbsp;million at the time of the theft, although the massive outflow of tokens briefly caused the NIGHT token price to drop by about 43%.

Cardano Midnight bridge exploit

Wanchain bridge on Cardano exploited for more than $9&nbsp;million

Summer Finance, a defi platform that provides "institutional defi vault infrastructure", was exploited for $6&nbsp;million in an apparent <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker used a flash loan to deposit $64.8&nbsp;million and then withdraw $70.9&nbsp;million, taking advantage of a price manipulation bug that allowed them to withdraw more than they deposited.<p>Shortly after the exploit, Summer Finance announced it had "no viable path forward other than to wind down operations". They added, "a meaningful portion of the team's own capital was held in the affected vaults, removing the runway we needed to rebuild."</p>

"Lazy Summer USDC Vault Exploit Post-Mortem: What Happened and What Comes Next"

"Sunsetting Summer.fi and the Labs Company"

Summer Finance exploit

Summer Finance exploited for $6&nbsp;million, shuts down

The Solana deployment of the Across <button class="define-target" id="bridge">bridge</button> was hacked for around $3.35&nbsp;million. According to Across, the stolen funds belonged to Risk Labs, the foundation supporting the project, rather than users of the bridge.

Across Protocol exploit

Across Protocol exploited for $3.35&nbsp;million

The Allbridge blockchain <button class="define-target" id="bridge">bridge</button> was exploited for $1.66&nbsp;million in a <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker took advantage of a flaw in the project's logic that reprices assets against one another, after discovering that the same would happen even when borrowing an asset against collateral denominated in the same token. They were able to manipulate the project's internal pricing logic so that the asset's actual price diverged away from reality, pocketing $1.66&nbsp;million in proceeds.

Allbridge exploit

Allbridge exploited for $1.66&nbsp;million

Balance Coin, a small <button class="define-target" id="algorithmic-stablecoin">algorithmic stablecoin</button> built on BNB Chain, lost its dollar <button class="define-target" id="peg">peg</button> and crashed to fractions of a cent after an attacker successfully exploited a flaw in its pricing logic. The attacker was able to trick the system into accepting an incorrectly low bitcoin price, which they then used to drain multiple vaults used by the project's lending protocol.<p>The attacker ultimately profited by about $912,000, consisting of funds stolen from 42DAO, the entity that runs the Balance protocol.</p>

"Balance stablecoin collapses 99% after $1 million exploit drains its bitcoin vaults"

Event	Date	Amount More info
Ostium exploit	July 15, 2026	$24,000,000
Bonzo Lend exploit	July 10, 2026	$9,050,000
Cardano Midnight bridge exploit	July 20, 2026	$9,000,000 – $10,000,000
Summer Finance exploit	July 6, 2026	$6,040,000
Across Protocol exploit	July 17, 2026	$3,350,000
Allbridge exploit	July 19, 2026	$1,650,000
Balance Coin algorithmic stablecoin crashes	July 21, 2026	$912,000