No one is willing to admit they are the snowflake that triggered the disaster during an avalanche. When users see their assets instantly evaporate from their accounts, they instinctively suspect that the protocol has run away with the funds. But on-chain data tells a different story — recent fund drain incidents of a major lending protocol were not due to management fleeing with the money, but rather a carefully orchestrated oracle manipulation attack.

Here's what happened: hackers used flash loans to artificially create extreme price fluctuations in low-liquidity trading pairs. Because the protocol’s price feed mechanism has update delays (on-chain data sources often lag by 5-30 seconds), the system was deceived within this time window. A token that was originally worthless was manipulated by the hacker to be valued at millions. The hacker then used these "overvalued" tokens as collateral to easily borrow all the ETH and BNB in the protocol. When prices normalized, all that remained was a false set of on-paper figures.

This trick isn’t new — the industry has been discussing oracle risks for three years. So why, in 2025, can such attacks still precisely target top-tier protocols? The core issue lies in the mismatch between existing price feed designs and the actual trading environment. Many projects, in an effort to promote "full decentralization," forcibly rely on on-chain price sources as the sole reference, completely ignoring the liquidity fragility of these sources. In an era of fragmented liquidity, it’s like installing a easily contaminated periscope on a submarine — every signal the operator sees could be fake, ultimately leading to an unintentional collision with the abyss.