A sophisticated market manipulation on Tuesday triggered approximately $36.39 million in liquidations across Morpho’s PT-reUSD looped positions, according to blockchain security firm PeckShieldAlert.
The incident involved an anonymous wallet that aggressively purchased yield tokens (YT) tied to reUSD, temporarily spiking the implied annual percentage yield to around 20% before rapidly exiting the position.
The move exploited the inverse relationship between yield tokens and principal tokens (PT), devaluing PT collateral and forcing automated liquidations of highly leveraged borrowers.
The events unfolded as of 8:00 AM UTC on August 25, 2026, and have drawn sharp attention across DeFi circles.
reUSD, a yield-bearing stablecoin product linked to the re[.]xyz ecosystem, is tokenized into PT and YT components on secondary markets. PT represents the principal redeemable at maturity, while YT captures the floating yield. Many users had been looping PT-reUSD as collateral on Morpho to amplify returns, creating concentrated exposure that proved vulnerable to short-term price swings.
Anatomy of the Attack
PeckShieldAlert identified the wallet 0x854e…690d as the primary actor. On-chain data from Etherscan shows the address conducted a series of market buys of YT-reUSD that drove the implied APY sharply higher, briefly exceeding 20%.
The key liquidation transaction, executed successfully at 04:38 UTC on August 25, shows the liquidator seizing roughly 11.7 million PT-reUSD collateral from the targeted borrower on Morpho while repaying the outstanding debt.
Charts shared by the firm illustrate a steep spike in the implied yield curve followed by an equally rapid reversal once the position was dumped.
Because YT and PT prices move inversely, the elevated yield expectation immediately marked PT-reUSD lower. Positions using PT as collateral on Morpho, many of them looped for leverage, crossed liquidation thresholds en masse.
Independent analysis from DeFi researcher 0scar (@0scaronchain) provided a more granular reconstruction. “0x854e… starts TWAP-buying YT-reUSD to push down the price of PT,” 0scar wrote. “Borrower 0xaa34… was sitting at a 90.9% LTV. By buying YTs, 0x854e pushed 5.4M PT into a pool that held 3.1M PTs. The 15-min TWAP price falls to 0.9647, causing 0xaa34 to be flagged for liquidation.”
0scar further noted that the liquidator address and the YT buyer appear to be the same entity, linked through repeated gas payments. After seizing the collateral, the actor combined the newly acquired YT with the liquidated PT to redeem underlying reUSD with minimal slippage.
Realized profits from the sequence were estimated at least $360,000, with additional unrealized gains from related positions still open. A subsequent correction clarified that the liquidated borrower had been holding YT as a hedge against rate spikes, making the setup an especially attractive target for an adversary monitoring health factors and oracle sensitivity.
Oracle Design and Leverage Risks Exposed
At the heart of the episode lies the Morpho market’s reliance on a 15-minute time-weighted average price (TWAP) oracle. In low-liquidity, long-dated PT pools, such a window proved insufficiently robust against deliberate TWAP manipulation.
The attacker needed only a relatively short window of concentrated buying to move the oracle feed enough to tip marginal positions into liquidation. Once liquidations began, the cascade amplified the impact, producing the $36-plus million figure reported by PeckShieldAlert.
The episode underscores a recurring tension in yield-tokenization strategies. Looping PT collateral can generate attractive leveraged yields under normal conditions, yet it leaves borrowers exposed to basis risk and oracle latency.
When an adversary can profit both from the initial yield-token trade and from subsequent liquidations, the incentive to force such events grows. As 0scar observed, “this type of ‘MEV’ is a looper’s nightmare. Play too close to the sun and you’re inviting sophisticated players to liquidate you.”
Market Response and Broader Implications
DeFiLlama data shows that trading activity in related Morpho markets showed immediate stress, with some participants reporting tighter risk parameters and reduced leverage appetite in the hours following the liquidations.
Security monitors and yield-focused researchers have called for stronger oracle configurations—longer TWAP windows, multi-source pricing, or circuit-breaker mechanisms—for markets involving thinly traded PT/YT pairs.
Confirming the attack, Re protocol shared a note on X, noting that its reUSD stablecoin remains unaffected and the Morpho market incurred no bad debt.
“A market-price movement in the Pendle PT-reUSD oracle used by a third-party Morpho market triggered liquidations of leveraged PT positions,” the Re team said. “We are investigating whether the PT market price was intentionally manipulated and are working with the relevant teams on a safer oracle configuration.”
At the time of publishing, Morpho has not shared any statement regarding the incident.
For now, the episode serves as a high-profile reminder that even mature lending protocols remain susceptible to carefully engineered attacks when leverage, low liquidity, and short-horizon oracles intersect.
This is a developing story and more information will be added as the event unfolds.
Also read: Galaxy Finds $115M Lost in Coldcard Exploit Across 8,865 Addresses
