Robdog 🍾

Building @corkprotocol - The Tokenized Risk Protocol

Prev founded @toucanprotocol and Vultus (acquired)

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Andrew Curran @AndrewCurran_]

Most of the recent math results were not reached by a swarm, the way Navier–Stokes was. I think that part got lost in the excitement around the release. OpenAI's unnamed internal model, which I'm going to call Aeon, reached most of them in one shot, from a single prompt, with no interruptions. This model did not even exist before the end of August, and it is still training. Notice how the returns are not dropping off? That chart is from a month ago. It is a log scale. What does Aeon look like now?

On average, each result used three hours of thinking. Aeon was given 4000 problems to work on by OpenAI. How many more have been solved in the last three days? That number is not zero.

It's like hearing notes in a song that is slowly rising. I don't think Pacing the Frontier was just about Hugging Face or hacking. They've seen how close we are to closing the loop, and as the hour draws near, their resolve begins to quaver. The last piece was model creativity, and I think that threshold was crossed internally by Anthropic and OpenAI in September. You see it in Opus 5.5, which gets it from Fable 5.5. You see it in the math results from Aeon.

All that was needed to start the event was the ability for models to think of novel ways to improve themselves. That was the last piece. This is directly analogous to the ability to think of strange, alien ways to solve math problems: solutions so inhuman that they are difficult to express in existing human terms, so the proof winds up incomprehensible. I think these same kinds of alien solutions are now being applied to model improvements internally. That's what all this recent consternation is really about. They see the invisible frontier. And they see what is about to happen.

[Robdog 🍾 @robdogeth]

@GavinSBaker If Open AI was able to solve hundreds of the hardest unsolved math problems, whilst LLM architectures have several orders of magnitude potential to improve inference efficiency

Is there not a major looming risk a 100x efficiency improvement will crash GPU demand?

DWDM all over

[Vasiliy Shapovalov @_vshapovalov]

Had to explain it to a few folks, apparently it helps understanding the argument better.

- Elliptic cryptography (used in almost all blockchains) is built on clever tricks and fancy math assumptions, an engineering analogy would be self-stressed structures
- AI labs breaking math assumptions left and right lately, might break elliptic crypto too (maybe already did!)
- Better use something dumb and straightforward, more like solid concrete bricks, like hash-based cryptography

Coincidentally it would also be post-quantum safe but it's not the point.

[Robdog 🍾 @robdogeth]

It might be all of finance, including offchain banking, actually should be in bunker mode

[Justin Drake @drakefjustin]

Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.

Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase).

Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets.

IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).

Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.

Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?

Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.)

Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once.

Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.

I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026).

Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS.

Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security.

The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.

[Robdog 🍾 @robdogeth]

@SemiAnalysis_ It's just that claude api pricing is crazy overpriced and the token consumption per model is very different. Imo very inaccurate to real usage

[Robdog 🍾 @robdogeth]

Four significant model releases in a week, and the interesting part is how differently they trade off.

Fable 5.1 is still the best coder. I run it on low, which now feels comparable to the previous version at max.

Astra is stronger at reasoning and planning and weaker at code, so it gets everything that is not code. Cheaper than Fable and about as fast.

Gemini Flash is around 100x cheaper and roughly on par with Opus 5, and it is the first Google model I would actually reach for. Muse is in the same class on speed and price.

Knowing which model to point at which job has become its own skill.

[OpenAI @OpenAI]

We’re sharing a solution to the Navier-Stokes Millennium Prize Problem, one of the deepest problems at the frontier of mathematics.

The proof was produced by a group of agents, using an OpenAI next-generation model significantly more capable than GPT-6 Astra.

The problem concerns whether the description of smooth three-dimensional fluid motion modeled by the Navier-Stokes equations can break down. It has remained unresolved for roughly 90 years.

[Robdog 🍾 @robdogeth]

Fable 5.1 is insanely good

In one shot, it was able to increase the speed of a monte carlo model I built by over 10x whilst maintaining byte-identical outputs.

It is truly a new level of commercially available machine intelligence that will unlock the development of more complex products using AI.

What is available behind the scenes at Anthrophic is likely much further advanced than Fable 5.1. If Fable could enact such levels of complex optimization, I think it is reasonable to assume that internally similar models can autonomously accelerate and optimize the development of LLMs at Anthrophic.

There is a wide debate about when we will reach RSI (recursive self improvement) of models. I would argue on some level we must already be there. Even if the whole architecture and development is not autonomous, Fable 5.1 is at a level of intelligence where it can meaningfully contribute towards model development and optimization, autonomously.

Fable will get distilled by open source in a matter of weeks/months, such that the rest of the ecosystem catches up. When they do, Anthrophic will release the next model, and so forth. There is no incentive for Anthrophic to release their best models, because whatever gets released will rapidly be copied. As such, there is really no way to tell how far along Anthrophic and Open AI are internally as they harvest the results of RSI. The level of capability we are just now getting access to, was already available to selected partners 6 months ago (Mythos). The Hugging Face incident further illuminated the size of the gap between what insiders and the public have access to.

What is becoming abundantly clear is that access to the true frontier, is becoming increasingly privileged and even if open source catches up to what is commercially available, I they are far behind what the frontier has to offer behind the scenes, and as RSI accelerates development the gap might only be increasing.

[Robdog 🍾 @robdogeth]

The smart contract auditing business will not exist in 12 months

[Xiangyu Qi @xiangyuqi_pton]

https://t.co/irlQIOxMqS

Astra achieves a full 100% success rate on ExploitBench, so we had to build an internal refresh using newly disclosed vulnerabilities from June through August that fall after the model’s knowledge cutoff.

On this refreshed benchmark, Astra remains dramatically stronger than GPT-5.6 Sol while using far fewer tokens.

This result, together with several other pieces of evidence, has led us to believe that Astra has reached the “cyber-critical” capability threshold under our Preparedness Framework.

[Robdog 🍾 @robdogeth]

@SteakhouseFi Agree!

On the oracle config - a simple solution to make price manipulation much more expensive would be to add a check on the secondary market price of the underlying.

If not impaired: Use time-decay.
If impaired: Use PT TWAP

[Robdog 🍾 @robdogeth]

@EthanDeFi_ That's fair, it was certainly not an intended outcome though with these types of actors their lawyers would never allow them to say that...

[Robdog 🍾 @robdogeth]

@LlamaRisk That would indeed have solved this issue but it also shuffles the risk to lenders. What happens if there is real impairment of the underlying? This was the primary motivation for the TWAP quoted in USDC - to protect lenders.

https://t.co/mUp59GKRDe

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Robdog 🍾 @robdogeth]

@BaptisteCota Thx!

Indeed, perhaps the average CT is on the other side of that trade

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Robdog 🍾 @robdogeth]

@riksucks But if you just use linear discount it's effectively hardcoded in the case of underlying impairment

Wrote a longer analysis on this here

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Robdog 🍾 @robdogeth]

@vmihov Ty ser

[Robdog 🍾 @robdogeth]

@MarcinRedStone Would be interesting to run the calculation on how large of an arbitrage there is to price-manipulate those other lending markets?

Fundamentally the oracle design needs to change, wrote more on this here curious what you think?

https://t.co/mUp59GKRDe

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Robdog 🍾 @robdogeth]

Yes but it's effectively hardcoding the value of the SY which transfers risk from borrowers to lenders.

I think there is a better design than what was used here but I would argue hardcoding it to a time-decay function without any way of pricing impairment of the SY is arguably a worse design

https://t.co/n84wLCzr4z

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Robdog 🍾 @robdogeth]

@0scaronchain My estimate was the realized gain was about 3x that, but good analysis. Wrote further detailed analysis on this here:

https://t.co/mUp59GKRDe

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.

[Robdog 🍾 @robdogeth]

@0xGeeGee 100% - we could do a much better job at explaining the risk factors for both borrowers and lenders

Wrote a longer analysis on this here:
https://t.co/mUp59GKRDe

[Robdog 🍾 @robdogeth]

Liquidation Heist: Breaking down the reUSD oracle manipulation attack

Last night an unknown wallet executed an oracle price manipulation attack which exposed highly levered looping trades in the PT-reUSD-10DEC2026/USDC Morpho market to be liquidated, resulting in $35,188,279 of liquidations and a net profit of $920,781 for the attacker. In this post I break down exactly what happened and what we can learn from it.

The Morpho Market Setup

In the last months, loopers have been flocking to a new form of yield arbitrage between reinsurance capital from Re (.xyz) and onchain borrow rates. The market which was attacked was the PT-reUSD-10DEC2026/USDC, which at it’s recent peak had $70m of borrows.

The primary use case for this market was to loop reUSD Pendle PTs, which were consistently earning about 10-11% fixed yield against the 8.8% average borrow rate in this market. At a Liquidation Loan-To-Value (LLTV) of 91.5%, loopers could lever up to 10.5 times and as a result achieve an annual yield of 34.6%. Since reUSD is a senior tranche reinsurance token, that is immediately redeemable onchain against a cash buffer the size of 50% of its supply (source: re docs) - the risk of holding reUSD is in theory fairly low from both a strategy and duration point of view, making it a suitable candidate for looping trades. As a result, this Morpho market attracted tons of borrowers and lenders (including vaults from Wintermute, Steakhouse, RockawayX, Clearstar, Keyrock - none of which lost any funds in this event).

The crucial kink in the armor of this trade from a loopers point of view, was the oracle configuration. It is configured as: PT/USDC price = min(Pendle 15-minute PT-to-USDC TWAP, 6% linear-discount curve). So it is the lower of either of the two rates: A linear discount model or a 15min time weighted average price (TWAP) of the PT denominated in USDC.

Steakhouse eloquently expressed the case for this design (which I agree with) as “generally good practice for Pendle oracles to mitigate the possibility of bad debt in the event of an impairment in the underlying asset. “ In practice, what this means is that if there is an impairment of the underlying reUSD, the oracle will pick this up. The alternative which many markets deploy is to hardcode the price with a time-decay curve which can result in bad debt if the underlying is impaired as we have seen multiple times in the past. Fundamentally, the design is a risk transfer from borrowers to lenders. The position becomes safer for lenders to underwrite, but exposes borrowers at extreme levels of leverage to liquidation in the event of even a small impairment of reUSD or the PT.

The attack

On Aug-25-2026 04:28:47 AM UTC a wallet (0x854e3f3b521dbae34cb111ebef0dce41d8b5690d) freshly funded with 1m$ from Gate, mints 1m$ worth of reUSD, converts it to Pendle SY reUSD and proceeds to use the funds to aggressively purchase YT-reUSD-10DEC2026, which has the consequence of roughly doubling the YT price from 0.029 to 0.0575, consequently dropping the PT side to to 0.9425 at the bottom (the Pendle chart below doesn’t show the true bottom).

Because borrower LTV ratios are calculated based on the value of the PTs as collateral, and these dropped in value by ~3%, this was sufficient to cause a cascade of liquidations. Liquidators earn a 2.616% incentive to perform liquidations in this event, which resulted in $920,781 in collected oracle bonuses.

The main liquidator contract (0x51a453d677396F62fbb1dff9925a205fa96fAB5e) was funded by the same Gate wallet at the same time as the oracle manipulator address, so we can safely assume this was the same actor.

Borrowers lost a total of $1,203,803 from the oracle bonus and liquidation at an unfavorable market rate. Because of relatively high rate of effective leverage, the equity losses amounted to approximately 30-40% for the affected borrowers (see img below).

The legality of this market operation is dubious at best. Given the funds came from a CEX at a relatively large size, it should be possible to trace the manipulation back to a specific entity. The legal precedence here is unclear, but this smells like crime.

Oracle design

The fundamental question this event raises is one of oracle design. Is it wise, to configure markets with 15 min TWAPs on thin liquidity, and support 70m$ of borrow capacity? I would argue the design is better than hardcoding oracles as many PT looping markets do, which has blown up for lenders more than once. A major challenge for borrowers is understanding the risks present in oracle design - which I believe as an ecosystem we need to do a better job at communicating. It is a wide and unstandardized design space, that is highly technical, which has huge implications on the risk for both borrowers and lenders. The devil, is truly in the detail. In this case, the oracle meant a risk transfer from lenders to borrowers. At the same time, borrowers are able to capture 34.6% yields at 10x leverage, so you might rightfully say “no wonder this comes at some risk!” - If you are levered to your tits and earning 30%+ yield, then you simply cannot cry in the casino.

I do think there is a fair critique to the oracle set-up in terms of it’s configuration compared to it’s design objectives. If the goal is to guard against impairment of reUSD - the oracle configuration should perhaps have some check against underlying impairment, before printing a lower value. This could balance both the needs of borrowers and lenders, without enabling this type of heist. Relying on Pendle secondary prices at a 15m TWAP, can be relatively easily manipulated, even with $30m+ of liquidity, as we saw today. At the same time, we cannot truly say the current design had a “bug”, in a sense the bug for the borrower is a feature for the lender.

Every blow-up is a chance to make the system itself more resilient, having spent a fair bit of time underwriting vault risk I think it is clear we have come quite far over the past year in terms of risk management and oracle configurations, but there is more work to be done. Onwards.

Give @robdogeth to stay up to date on crypto and vault risk.