One-line brief
On August 25, 2026, one wallet used a position worth about $320,000 to push the implied annualized yield of YT-reUSD from roughly 11% to 20% within nine minutes. The PT-reUSD market price fell about 3%, the move passed through an oracle and roughly $36.39 million of looping leverage on Morpho was liquidated. No contract vulnerability was exploited, reUSD did not depeg, lenders had no loss and the market created no bad debt. The weak point was the combination of thin liquidity, a short-window TWAP oracle and less than 3% of buffer below a 91.5% liquidation threshold.
1. Incident overview: the outcome was one hundred times the input
Around midday Beijing time on August 25 (UTC 04:28–04:37), wallet 0x854e...690d completed 11 Pendle trades, exchanging about $320,000 of SY-reUSD for YT-reUSD. YT represents the right to receive yield before maturity. Concentrated buying pushed the market's implied annualized yield from about 11% to 20%, after which the wallet sold quickly. Pendle splits a yield-bearing asset into principal token PT and yield token YT, whose prices move inversely; PT-reUSD therefore fell about 3%.
The price move entered another protocol through its oracle. The Morpho PT-reUSD/USDC market valued collateral using the lower of a 15-minute market average and a fixed discount curve converging to $1 at the December 10, 2026 maturity. As the market price fell, collateral value fell too. With LLTV at 91.5%, borrowers had repeatedly collateralized PT-reUSD, borrowed USDC and bought more PT, leaving less than 3% of buffer. About $36.39 million of looping positions were liquidated, with 33 liquidation events affecting 19–20 borrower positions. More than 38 million PT-reUSD was taken as collateral, while about $35.19 million USDC and $960,000 USDT of debt was repaid.
The three project-side statements should be kept separate. Re said reUSD itself was unaffected, the Morpho market had no bad debt, and it was investigating whether the PT price had been deliberately manipulated while working on safer oracle settings. Pendle said its price source was configured correctly and operated as designed. Steakhouse Financial, the vault curator, said lenders had no loss and the market had no bad debt. The operator's eventual profit remains a third-party estimate ranging from about $360,000 to $920,000; there is no official audit conclusion.
2. Attack and fund-flow chain
The diagram below summarizes the chain. Some numbers are third-party estimates and the official statements remain authoritative.
3. Technical breakdown: no code bug, but the money still moved
Every contract in this event executed as designed. The loss appeared at the boundary between market parameters and market structure.
3.1 PT and YT are two halves of one asset
Pendle splits a yield-bearing asset into PT, the right to reclaim principal at maturity, and YT, the right to receive yield before maturity. Together they equal the original asset. When buying pressure concentrates on YT, PT must become cheaper to rebalance the pair. That seesaw is intentional; the problem was that the other end of the seesaw was the collateral valuation in a lending market. With limited depth, several hundred thousand dollars of continuous buying can nearly double an implied yield.
3.2 Why a 15-minute average did not stop the move
A short-window average is often treated as an anti-manipulation measure, but its effectiveness depends on window length and market depth together. The 11 trades were compressed into nine minutes and covered most of the 15-minute window, so the average moved materially. The oracle selected the lower of the TWAP and the fixed discount curve. That suppresses overvaluation in normal conditions, but during a fast decline it prefers the depressed number and transmits the market shock into collateral value.
3.3 A 91.5% threshold plus looping leverage leaves a daily-volatility buffer
Borrowers collateralized PT-reUSD, borrowed USDC and bought more PT repeatedly. Each loop pushed LTV toward the liquidation threshold, leaving less than 3% of buffer across the affected positions. Near maturity PT normally converges toward $1 with low volatility, which can make a high LLTV look reasonable. Low volatility is a historical condition, not a promise. A single 3% move sent 19–20 positions into liquidation, and the liquidation itself added selling pressure.
3.4 “No bad debt” protects lenders, not borrowers
No bad debt means liquidation completed in time, collateral covered the debt and vault depositors did not absorb a shortfall. Liquidated borrowers still paid the liquidation discount and lost position value. Compressing those facts into “nobody was harmed” would be inaccurate.
4. Delta's forensic view: evidence and controls for an economic event
For a contract-bug event, the starting point is the transaction call stack. For an economic event, the starting point is the market parameter set. Delta & Capital normally reviews:
Manipulation-cost reconstruction: use pool depth at the event time to estimate the capital needed to push price to the liquidation line. This is the key test of whether the structure remains reproducible.
Window alignment: align trade timestamps with oracle-window length and liquidation blocks to confirm the transmission path rather than infer it only from the result.
Operator/liquidator relationship: compare fund flows, gas funding and behavioral rhythms between the profit address and liquidation executors to assess common control or cooperation.
Profit-scope separation: keep trade position, net cost, liquidation discount and realized profit separate. Inflow size is not principal, and floating profit is not realized profit.
Parameter risk inventory: record collateral depth, oracle type and window, LLTV and vault caps in a comparable table to find other markets with the same conditions.
Compliance-grade preservation: archive transaction hashes, block heights, official-statement versions and screenshots so later updates remain traceable.
These events often have no conventional recovery target. The trades occur in an open market, the execution follows protocol rules and the loss lands on liquidated positions. Borrowers therefore have their strongest defenses before opening a position; post-incident pursuit is limited.
5. Action list for borrowers and protocol teams
For borrowers and leverage users
- Before opening a position, check real collateral depth, oracle type and window, and the market LLTV. Together they determine how much capital can liquidate you.
- Treat buffer as the primary risk metric. A looping position with less than 5% of buffer delegates survival to a few minutes of price action.
- Be cautious with high leverage on low-volatility assets. PT convergence near maturity is a statistical pattern, not a price guarantee.
- Watch the derivative market for the collateral. A move in its yield-token market can flow directly into your collateral valuation.
- Deleveraging while liquidity thins or maturity approaches is cheaper than waiting for liquidation.
For protocols and vault curators
- Evaluate oracle windows together with market depth. Window length alone is not a protection metric.
- Use more conservative LLTVs for derivative collateral whose price is formed in another market.
- Stress-test cross-protocol transmission: not only “what if collateral falls x%?” but also “what if y dollars are deployed in the other market?”
- Communicate at the right level. No bad debt, no lender loss and no borrower loss are three different conclusions.
6. Industry lesson: audits do not cover parameter risk
Yield-token collateral, high LLTV and looping leverage have spread quickly because they assume a stable price source. This event shows that when the source is a short-window average in a thin market, a position worth hundreds of thousands of dollars can generate liquidation volume in the tens of millions. A passed audit, designed execution and no bad debt can all be true while borrowers still lose money.
Expected adjustments include longer oracle windows, lower LLTVs for derivative collateral, caps on vault exposure to one market and smoother liquidation pacing. Users should move their focus from “was the protocol audited?” to “how deep is the collateral price source and how much buffer remains?” Until parameters change, the same path can recur elsewhere.
7. Key concepts
PT (principal token): The right to reclaim principal at maturity; its price converges toward face value as maturity approaches.
YT (yield token): The right to receive all yield before maturity; its price moves with implied yield and inversely to PT.
SY (standardized yield-bearing asset): Pendle's wrapper for a yield-bearing asset before it is split into PT and YT.
Implied yield: Annualized yield expectations inferred from PT/YT prices; YT buying pressure pushes it higher.
TWAP oracle: A quote based on average execution price over a period. Resistance to manipulation depends on the window-depth combination.
LLTV: The highest collateral ratio permitted by a lending market before liquidation. Higher values leave less buffer.
Looping: Collateralizing an asset, borrowing stablecoins, buying more of the same asset and repeating the cycle.
Bad debt: The debt shortfall left after liquidation when collateral does not cover the obligation. No bad debt does not mean no borrower loss.
8. Frequently asked questions
Q: Was this a hacker attack?
A: No smart-contract vulnerability was exploited and Pendle and Morpho contracts executed as designed. Re is investigating whether the PT market was deliberately manipulated; the official conclusion is not yet final. “Oracle manipulation attack” is a media description, not a confirmed finding.
Q: Did reUSD depeg?
A: No. The decline occurred in the secondary-market price of PT-reUSD. ReUSD itself was unaffected, as separately stated by Re and Steakhouse Financial.
Q: If there was no bad debt, why describe a $36.39M loss?
A: $36.39 million is the size of positions liquidated. No bad debt means lenders and vault depositors were fully covered; liquidated borrowers absorbed the discount and position loss.
Q: Why did the 15-minute average not protect the market?
A: Eleven trades completed within nine minutes and covered most of the 15-minute window. In a thin market, the average was pulled materially. A window is useful only when it is matched to the capital required to move that market.
Q: How can ordinary users avoid similar losses?
A: Confirm real collateral depth, oracle method and window, LLTV and your own buffer before opening a position. Thin-buffer looping positions can be liquidated by a short move and usually leave little room for recovery.
Content support
This article was supported by Delta & Capital's blockchain-security and compliance research team, based in Hong Kong. Its work covers CEX/DEX account restrictions, risk-control and freeze appeals, stolen-asset tracing, blockchain data analysis, transaction forensics, KYT/AML controls, SOW reconstruction and cross-chain, multi-asset path analysis. The team also prepares evidence and technical support for police reports and judicial cooperation. This is public-interest education and does not promise recovery or unfreezing.
Risk and compliance notice
This article is security and anti-fraud education, not investment advice or a recovery guarantee. Incident data comes from public reporting and may change as investigations develop. Virtual-asset activities in mainland China are not protected by law; victims should report promptly to police and pursue lawful remedies, while remaining alert to secondary scams.