On Thanksgiving morning in 2020, DAI was worth $1.00. It was also worth $1.30.

Both numbers were true at the same moment. On Coinbase Pro, thin holiday liquidity pushed DAI up toward $1.30 across three pairs in about an hour. On Kraken and Bitfinex, the same token sat quietly near its peg, doing nothing interesting at all.

Compound had already decided which of those numbers counted. Its price feed read Coinbase, and roughly $89MM of borrower positions were liquidated on the strength of a number most of the market never saw (Decrypt, November 2020). A single yield farming address had 46.2MM DAI repaid and 49.8MM DAI seized.

Nobody broke a smart contract. The system behaved exactly as designed. The design had picked a venue.

I spent a long time in banking sitting near benchmark prices, and what strikes me about that morning is how familiar it felt. We talk about price discovery as though a price were an object under a rock, waiting to be found. It is not.

A price is constructed. Somebody chooses which sources count, over what window, combined by what method, published under whose signature. Change any one of those four and the number changes, and every position marked against it changes too.

That construction is what an oracle is. It is not a window onto the market. It is an opinion about the market, carrying more decimal places than an opinion deserves.

My argument here is that oracle risk is not a data problem and never was. It is a governance problem, the same one traditional finance answered badly twice before crypto existed, and the industry is currently hardening the wrong half of it.

Nobody Discovers a Price. Somebody Constructs One.

Traditional finance learned this lesson at scale, and paid for the lesson twice.

The first was LIBOR. For decades the rate underpinning hundreds of trillions of dollars in contracts was assembled from panel banks submitting an estimate of what they believed they could borrow at. Not what they paid. What they thought they might pay.

Those estimates were trimmed and averaged into a published number the rest of the world treated as a fact. Regulators in the US, UK and EU eventually imposed more than $9Bn in fines for manipulating it (Council on Foreign Relations).

Notice how that was fixed. Supervisors did not simply watch the submitters more carefully. They replaced the benchmark with SOFR, built on observable Treasury repo transactions, and completed the transition in 2023. The repair was to delete the judgment step and anchor the number to trades that actually happened.

The second was the 4pm London fix. The WM/Reuters benchmark was calculated from trading in a one minute window around 16:00 London time, and it set the rate at which an enormous share of the world's index funds and corporates converted currency. Traders at competing banks shared client order information in private chat rooms and traded ahead into that window. On 12 November 2014, 6 banks settled for a combined $4.3Bn, with the FCA fining 5 of them £1.1Bn and the CFTC adding more than $1.4Bn (FCA, November 2014).

The repair there was different. The fix survived, but the window was widened from 1 minute to 5, because a longer window is more expensive to push around.

Two scandals, two repairs, and neither one changed the underlying fact. A committee still decides what the number is. All that changed was which choice the committee was allowed to make.

The Four Choices Inside Every Feed

Every oracle, on every chain, makes the same four choices that WM/Reuters and the LIBOR panel made. They are usually buried in documentation nobody reads until after the incident.

Which sources count

The Compound morning is the cleanest illustration in DeFi. DAI was near $1.00 on most venues and near $1.30 on one, and the protocol had chosen the one. Kraken and Bitfinex prices would not have triggered a single liquidation.

If the underlying mechanics are new to you, my DeFi primer walks through how lending protocols value collateral before deciding whether to seize it.

Modern feeds spread that choice across more shoulders. Chainlink aggregates at 3 levels, with each node taking a median across several data aggregators, then the network taking a median across nodes, requiring a quorum such as 14 of 21 to publish (Chainlink). Pyth takes the opposite route, sourcing from more than 120 first party publishers including trading firms like Jane Street and CBOE, who push their own prices rather than having them scraped.

Both are defensible. Both are still a choice about whose view of the market is admissible, made by whoever wrote the config.

Over what window

A spot price is honest about the current moment and trivially cheap to distort for one block. A time weighted average is expensive to distort and dishonest about the current moment, because it is deliberately telling you about the recent past.

MakerDAO chose safety and found the other edge of it. Its Oracle Security Module delayed price updates by roughly an hour, which is excellent protection against a momentary spike and terrible protection against a genuine crash. On 12 March 2020, ETH fell more than 50% in a day, network congestion spiked gas costs, and liquidators won collateral auctions with bids of 0 DAI, taking $8.32MM in ETH for nothing and leaving $4.5MM of unbacked DAI in the system (Glassnode, 2020).

There is no window that is right. There is only a window that is wrong in the direction you chose.

By what method

Median or mean, trimmed or raw, volume weighted or not. A mean is easy to drag with one outlier and a median is not, which is why nearly everything serious now uses medians.

Then there is the update rule, which is where most of the surprise lives. Chainlink feeds publish when the off chain price deviates past a threshold, 0.5% in Chainlink's own worked example for ETH/USD, with a heartbeat timer forcing an update if the threshold is never crossed. Thresholds are set and published per feed, so the only number that matters is the one on the asset you actually hold.

That means the on chain price is legitimately allowed to be wrong by up to the deviation threshold at any given instant, by design. A protocol that lends at 100% of oracle value against a feed with a 2% deviation band has handed away 2% for free and called it precision.

Who is allowed to publish

This is the choice almost nobody audits, and it is the one now doing the most damage.

Every feed ultimately reduces to a set of keys that may sign a price the chain will accept. Aggregation across sources is a defense against bad data. It is not a defense against a valid signature carrying a fabricated number.

When to refuse to answer

The most underrated design decision is whether a feed is permitted to say it does not know. Pyth propagates a confidence interval alongside each price, so a consuming protocol can pause when the band widens instead of acting on a number it should not trust. OWASP says the same thing in blunter terms, recommending that protocols halt borrowing and liquidations on suspicious or unavailable data (OWASP SC03:2026).

Most protocols do not build this. A feed that always answers is a feed that will eventually answer wrongly with total confidence.

What Breaks, and in Which Order

Set the incidents side by side and the pattern is not really about crypto. Each one is a choice from the list above, meeting the day it was wrong.

Incident Date The choice that broke Loss
MakerDAO Black Thursday Mar 2020 Window, an hour of deliberate lag $8.32MM at zero bids
Compound DAI Nov 2020 Sources, one venue counted ~$89MM liquidated
Mango Markets Oct 2022 Sources, a thin token's own market ~$110MM
Ostium Jul 2026 Authority, a compromised signer key ~$18MM
Moonwell Aug 2026 Sources, a small token as collateral $8.7MM

The losses are not large by the standards of a banking crisis. What makes them interesting is that in almost every case the code did what it was told. The vulnerability was upstream of the code, in a decision somebody made about what would count as true.

OWASP now ranks price oracle manipulation third on its 2026 smart contract list, spanning lending, AMMs, yield vaults, staking derivatives and bridges. Its 2025 case studies include a roughly $2MM loss at NGP Token and a $42MM loss at GMX, where manipulated pricing was an enabler alongside a reentrancy bug (OWASP SC03:2026).

Even that ranking understates the exposure, because a list of named root causes counts only the incidents where the oracle was the proximate cause, not the far larger set of positions marked daily against feeds nobody has stress tested.

The Case That the Price Was Real

The strongest argument against everything I have written is the Mango Markets case, and it deserves a proper hearing rather than a dismissal.

In October 2022, Avraham Eisenberg opened offsetting positions in MNGO perpetuals and bought MNGO heavily on the venues feeding Mango's oracle. The token's price rose, the notional value of his collateral rose with it, and he borrowed roughly $110MM against it. He then argued publicly that this was not theft but a highly profitable trading strategy, executed with real capital on open markets.

A jury convicted him in April 2024. On 23 May 2025, Judge Arun Subramanian vacated all of it, partly on venue grounds and partly on something more uncomfortable. Mango Markets had no terms of service, no rule against what he did, and no requirement that the loan be repaid (The Block, May 2025).

Take the steelman seriously. He bought a token on public venues at prices anyone could pay. The protocol's own chosen method read those trades and produced a number.

He borrowed exactly what that number entitled him to borrow. If the method is the rule, he obeyed the rule precisely, and the protocol simply disliked the result.

My answer is that the method was never intended to be the rule. It was meant to be a proxy for a fact outside the system, the fair value of the collateral, and a proxy that can be moved by the person relying on it has stopped being a proxy. That is a coherent position. It is also one Mango never wrote down anywhere, which is why a federal judge could not enforce it.

In traditional markets that gap is closed by a manipulation statute and 90 years of case law. On chain, in 2022, it was closed by nothing at all.

The Attack Surface Moved From the Method to the Authority

Here is the shift I think most people have missed, and it is the reason this piece is not a rehash of 2022.

DeFi actually fixed the math. Flash loan and ecosystem class oracle manipulations fell from nearly 19% of losses in 2022 to under 1% by 2025 (Immunefi). Medianized feeds, multiple sources, deviation bounds and time weighted averages did their job. The flash loan attack that defined an era is now a largely solved problem.

The losses did not stop. They relocated.

In July 2026, Ostium lost roughly $18MM on Arbitrum. Nobody manipulated a market. An attacker obtained a private key belonging to a price oracle, signed price reports the protocol accepted as valid, opened a BTC position at a fabricated $5,000 against a real market near $60,000, and looped the trade (CoinDesk, July 2026). Every aggregation defense in the design was irrelevant, because the number arrived correctly signed.

On 27 August 2026, Moonwell lost $8.7MM on Base when an attacker inflated the price of MAMO, a small token, from about $0.01 to $0.43, borrowed cbBTC and USDC against it, and exited. The protocol froze borrowing within hours by setting caps to 1 wei. The loss exceeded Moonwell's entire annual fee revenue of $8.6MM, and it was the protocol's third security incident of the year (crypto.news, August 2026).

Those two are different failures wearing the same jacket. Ostium was compromised authority. Moonwell was an admissible source that should never have been admissible, a token thin enough that its own market could be moved for less than the loan it unlocked. Neither was a clever manipulation of a well designed aggregation scheme.

This is the same finding I reached about key management, arriving from a different direction. The industry keeps hardening the cryptography and leaving the authority to sign it under a doormat.

Across the first half of 2026, TRM Labs counted roughly $972MM lost across a record 207 incidents, and the shape of that number is the whole argument in miniature. Smart contract exploits made up 125 of the 207 incidents, while infrastructure and operational compromises were only about 15% of incidents and roughly 76% of the money (TRM Labs, July 2026).

The math is getting better. The custody of the right to speak for the math is not.

What a Risk Manager Should Actually Ask

If you hold assets in a protocol, or you are an institution deciding whether to, the useful questions are narrow and answerable. Most can be answered in an afternoon from public documentation, which is what makes the neglect remarkable.

Ask which venues feed each collateral asset, and what share of that asset's global volume those venues represent. A feed built on venues carrying 5% of an asset's liquidity is a feed built on a market you could move yourself. Then ask what the deviation threshold and heartbeat are for every asset you are exposed to, and compare that threshold against the loan to value ratio being extended. Any gap where the permitted price error exceeds the collateral cushion is a standing invitation, sitting in the config where anyone can read it.

Ask how many keys can publish a price, who holds them, and whether they sit in hardware or a hot wallet. After Ostium, this is the question with the highest information value per minute spent, and it is almost never in a protocol's marketing.

Ask what happens when the feed goes quiet or the confidence band widens. If the answer is that the protocol keeps liquidating against the last known price, you have found the next incident. Then ask which assets are accepted as collateral and what the smallest of them costs to move by 40%, which is roughly what the Moonwell attacker needed. Small cap collateral is where oracle risk concentrates, because the cost of manufacturing a price scales with liquidity while the borrowing power it unlocks does not.

The signal I would watch through the rest of 2026 is whether protocols begin publishing oracle configurations the way banks publish capital ratios. Deviation thresholds, signer sets, source venues and staleness policy, in one place, updated when they change. A handful already do. Most still treat it as an implementation detail, and implementation details are where that $972MM went.

Build for the Day the Feed Is Wrong

DAI was worth $1.00 and $1.30 on the same morning in 2020, and the distance between those two numbers was a configuration choice made months earlier by somebody who was not thinking about Thanksgiving liquidity.

That is the part I keep returning to. Nothing about oracle failure requires a brilliant attacker or a novel exploit. It requires only that somebody chose sources, a window, a method and a signer set, and that the world eventually arrived at the day those choices were wrong.

Traditional finance needed two scandals, more than $13Bn in combined fines and a full benchmark transition to accept that a constructed number needs governance rather than trust. Crypto has now run the same experiment faster and cheaper, and sits at the stage where it has fixed the arithmetic and not the authority.

So here is my flag, and you can hold me to it. The next 12 months of oracle losses will be dominated by compromised signers and badly admitted collateral, not by clever manipulation of aggregation logic, and the protocols that avoid them will be the ones treating their oracle config as a governance document rather than a settings file. If the losses instead arrive from novel attacks on medianization itself, I will have called this wrong.

Every protocol you use has already decided what a price is. The only real question is whether anybody there can tell you how, and what happens on the morning the answer is $1.30.

Further Reading