The stablecoin crisis in the first two weeks of November 2025 exposed the fundamental flaws in the decentralized finance (DeFi) sector that scholars have warned about for years. The collapse of Stream Finance's xUSD, along with the subsequent chain reaction of failures involving Elixir's deUSD and numerous other synthetic stablecoins, is far from an isolated case of mismanagement. These events reveal deep-seated structural issues within the DeFi ecosystem regarding risk management, transparency, and trust.
What I observed in the Stream Finance collapse is not a clever exploitation of smart contract vulnerabilities, nor a traditional oracle manipulation attack. Instead, it reveals a more disturbing fact: beneath the glamorous rhetoric of 'decentralization', fundamental financial transparency has already been lost. When an external fund manager can incur a loss of $93 million without any effective oversight, triggering a cross-protocol chain reaction of up to $285 million; when the entire 'stablecoin' ecosystem loses 40% to 50% of its total locked value in a week, despite seemingly maintaining its peg, we must acknowledge a basic fact about the state of decentralized finance: this industry has learned nothing.
To be more precise, the current incentive structure rewards those who ignore historical lessons, punishes those who act with caution and conservativeness, and shifts the losses to the entire market when an inevitable collapse occurs. An old saying in finance is particularly relevant and harsh here: if you don’t know where the returns come from, then you are the source of the returns yourself. When certain protocols promise an 18% return through opaque strategies, while the yields in mature lending markets are only 3% to 5%, the high yield is likely the principal of the depositors.
The operating mechanism and risk transmission of Stream Finance.
Stream Finance positions itself as a yield optimization protocol, offering up to 18% annual returns on users' USDC deposits through its interest-bearing stablecoin xUSD. Its claimed strategies include terms like “Delta neutral trading” and “hedge market making,” which sound esoteric, but the actual operation is vague. In comparison, Aave offers an annual yield of about 4.8% for USDC deposits, while Compound is slightly higher at 3%. Basic financial knowledge tells us to be cautious of returns that are several times above the market average; however, users have still deposited hundreds of millions into the protocol. Before the collapse, the trading price of 1 xUSD reached as high as 1.23 USDC, showcasing its compound returns. At its peak, xUSD claimed to manage assets totaling $382 million, but data from DeFiLlama indicates that its peak total locked value was only $200 million, meaning that over 60% of the so-called assets existed in unverifiable off-chain positions.
After the collapse, Yearn Finance developer Schlagonia revealed its true mechanism: it is a systemic fraud disguised as financial innovation. Stream adopted a recursive lending model, creating synthetic assets without actual value support through the following process:
User deposits USDC.
Stream exchanges USDC for USDT through CowSwap.
Use these USDT to mint deUSD on Elixir (Elixir is chosen because it offers high yield incentives).
Cross-chain these deUSD to networks like Avalanche and deposit them into the lending market to borrow more USDC, completing a loop.
As a result, although this strategy has become complex and relies on cross-chain operations, it can still be considered a form of collateralized lending. However, Stream has not stopped there. It did not use the borrowed USDC solely to expand the collateral loop but instead minted xUSD again through its StreamVault contract, which caused the supply of xUSD to far exceed the actual value of the collateral held. With only 1.9 million dollars of verifiable USDC as collateral, Stream minted up to 14.5 million xUSD, inflating the scale of synthetic assets by 7.6 times relative to the underlying reserves. This is akin to a fractional reserve banking system without reserves, regulation, or a lender of last resort.
Its circular dependency with Elixir makes the entire structure precarious. During the expansion of the xUSD supply, Stream deposited 10 million USDT into Elixir, thereby increasing the supply of deUSD. Elixir then exchanged this USDT for USDC and deposited it into Morpho's lending market. By early November, the supply of USDC on Morpho exceeded 70 million, with borrowing exceeding 65 million, and Elixir and Stream were the main participants. Stream holds about 90% of the total supply of deUSD (approximately 75 million), while a significant portion of Elixir's reserve assets comes from loans provided to Stream through a private Morpho vault. These two stablecoins are essentially mutually collateralized, meaning a loss for one results in a loss for the other. This “financial cycle” inevitably leads to systemic fragility.
Industry analyst CBB pointed out the problem as early as October 28: “xUSD has about 170 million dollars of on-chain assets as support, but they borrowed about 530 million dollars from lending protocols. This is a leverage of 4.1 times and is built on many illiquid positions. This is not yield farming at all; it is a gambler's risk.” Schlagonia had also warned the Stream team 172 days before the collapse, stating that it would only take five minutes to check their positions to see that the collapse was inevitable. These warnings were public, specific, and accurate, yet they were ignored by users chasing high yields, curators eager for fee income, and various protocols supporting the structure.
When Stream announced on November 4 that an external fund manager had lost about $93 million in fund assets, the platform immediately suspended all withdrawals. Due to the lack of an effective redemption mechanism, panic spread instantly. Holders rushed to sell xUSD in the illiquid secondary market. Within a few hours, the price of xUSD plummeted 77% to about $0.23. This stablecoin, which once promised stability and high returns, evaporated three-quarters of its value in a single trading day.
Specific data on risk transmission
According to the report from the DeFi research institution Yields and More (YAM), the direct debt exposure related to Stream amounts to 285 million USD throughout the ecosystem. Key parties involved include:
TelosC: Facing a loan risk of $123.64 million due to accepting Stream assets as collateral (the largest single risk exposure).
Elixir Network: Borrowed $68 million through private Morpho vault (65% of deUSD reserves).
MEV Capital: Risk exposure of 25.42 million USD, of which approximately 650,000 USD has become bad debt (due to the oracle freezing its price at 1.26 USD when the market price of xUSD dropped to 0.23 USD).
Others: Varlamore ($19.17 million), Re7 Labs (one vault $14.65 million, another vault $12.75 million), as well as institutions like Enclabs, Mithras, TiD, and Invariant Group holding smaller positions.
Euler: Facing approximately $137 million in bad debts.
A total of over $160 million in funds has been frozen across various protocols.
Researchers point out that this list is not exhaustive and warn that “there are likely more stablecoins or vaults affected,” as the full picture of risk transmission remains unclear weeks after the collapse.
Elixir's deUSD plummeted 98% from $1.00 to $0.015 within 48 hours due to 65% of its reserves being concentrated in loans to Stream through the private Morpho vault, becoming the fastest major stablecoin failure case since the Terra UST collapse in 2022. Elixir facilitated redemptions for about 80% of deUSD holders (excluding Stream itself), allowing them to exchange at a 1:1 ratio for USDC, thereby protecting most community users, but this protective measure came at a huge cost, with losses being passed on to protocols like Euler, Morpho, and Compound. Subsequently, Elixir announced it would completely shut down all stablecoin products, acknowledging that market trust had been irreparably destroyed.
The broader market reaction shows a systemic loss of confidence. According to data from Stablewatch, within a week of the Stream collapse, yield-bearing stablecoins as a whole lost 40% to 50% of their total locked value, although most still maintained their peg to the dollar. This means that around $1 billion in funds flowed out from protocols that did not fail and did not experience technical issues. Users are unable to distinguish between quality projects and fraudulent ones, and thus choose to flee all similar products. The total locked value in DeFi dropped by about $20 billion at the beginning of November. The market is pricing in the risk of a widespread chain reaction, rather than just the failure of specific protocols.
October 2025: $60 million triggered chain liquidation
Less than a month before the collapse of Stream Finance, the cryptocurrency market experienced another catastrophic crash. On-chain forensic analysis indicates that this was not an ordinary market downturn, but a precision attack initiated at an institutional scale that exploited known vulnerabilities. From October 10 to 11, 2025, a carefully orchestrated market sell-off worth $60 million triggered oracle failures, leading to a chain reaction of large-scale liquidations across the entire DeFi ecosystem. This was not a case of over-leveraged liquidations due to positions being underwater, but rather a reiteration of the oracle system's design flaws at the institutional level, repeating attack patterns that have been recorded and disclosed multiple times since February 2020.
The attack began at 5:43 UTC on October 10, with $60 million worth of USDe being concentrated and sold off into the spot market of a single exchange. In a well-designed oracle system, the impact of such localized selling pressure would be absorbed by multiple independent price sources with time-weighted average price mechanisms, thereby minimizing manipulation risk. However, the actual oracle system adjusted the value of the related collateral (wBETH, BNSOL, and USDe) in real-time based on the spot price of the manipulated trading venue. A large-scale liquidation was triggered immediately. The system's infrastructure was overwhelmed, and millions of simultaneous liquidation requests exhausted the system's processing capacity. Market makers were unable to quickly submit buy orders due to interruptions in the API data stream and a backlog of withdrawal requests. Market liquidity was instantly depleted. A chain reaction formed a vicious cycle.
Attack techniques and historical precedents
The oracle faithfully reported the manipulated prices that appeared at a single trading venue, while prices in all other markets remained stable. Major exchange data showed that USDe fell to $0.6567 and wBETH dropped to $430. Prices in other venues deviated by less than 0.3% from normal levels. The liquidity pools of on-chain decentralized exchanges were minimally affected. As pointed out by Ethena founder Guy Young, “over $9 billion in stablecoin collateral was readily available for redemption” throughout the event, proving that the underlying assets themselves were not impaired. However, the oracle reported manipulated prices, and the liquidation system executed based on these prices, ultimately leading to the destruction of numerous positions based on valuations that did not exist in the market.
This is exactly the pattern that led to Compound being severely hit in November 2020: at that time, DAI's trading price on Coinbase Pro soared to $1.30 for one hour, while other markets remained at $1.00, resulting in $89 million in liquidations. The trading venue changed, but the vulnerability remained. This type of attack is similar to the method that destroyed bZx in February 2020 (stealing $980,000 by manipulating Uniswap oracles), the same as the method that severely impacted Harvest Finance in October 2020 (stealing $24 million by manipulating Curve prices and triggering a $570 million liquidity crisis), and consistent with the multi-exchange manipulation attack in October 2022 that caused Mango Markets to lose $117 million.
According to statistics, between 2020 and 2022, there were a total of 41 oracle manipulation attacks, resulting in losses of up to $403.2 million. The industry's response has been slow and scattered, with most platforms continuing to use oracle solutions that heavily rely on spot prices and lack sufficient redundancy. The amplification effect of these attacks highlights the importance of learning from these lessons as the market scales. In the 2022 Mango Markets incident, a $5 million manipulation led to a loss of $117 million, amplifying it by 23 times. In the October 2025 incident, a $60 million manipulation triggered a chain reaction with a significant amplification effect. The methods of attack have not become more sophisticated; rather, the underlying systems still possess the same fundamental vulnerabilities while the scale has increased.
Historical Pattern: Failed Cases from 2020 to 2025
The collapse of Stream Finance is neither a first nor an isolated case. The DeFi ecosystem has experienced multiple failures of stablecoins, each time revealing similar structural vulnerabilities. However, the industry continues to repeat the same mistakes, with each instance growing in scale. The recorded failures over the past five years exhibit a highly consistent pattern:
Unsustainable high yields: Algorithms or partially collateralized stablecoins offer returns far above market levels to attract deposits.
Suspicious source of income: High returns are usually subsidized by token issuance or new inflow deposits, rather than real business income.
Excessive leverage and opacity: The operation of the protocol implies high leverage, and the actual collateral rate is unclear.
Circular dependency: the assets of Protocol A support Protocol B, while the assets of Protocol B in turn support Protocol A, creating a fragile closed loop.
Collapse triggers: Once any shock occurs that exposes its insolvent nature, or when subsidies become unsustainable, a bank run will happen.
Death Spiral: Users panic and withdraw, collateral value plummets, chain liquidations occur, and the entire structure collapses within days or even hours.
Risk transmission: The collapse spreads to other protocols that accept the stablecoin as collateral or are associated with its ecosystem.
Typical Case Review:
May 2022: Terra (UST/LUNA)
Loss: Approximately $45 billion in market value evaporated within three days.
Mechanism: UST is an algorithmic stablecoin that maintains its peg through the minting and burning mechanism of LUNA. The Anchor Protocol provides an unsustainable 19.5% yield for UST deposits.
Trigger: Large-scale UST redemptions and sell-offs led to decoupling, resulting in LUNA hyperinflation and death spiral.
Impact: Led to the bankruptcy of several major crypto lending platforms such as Celsius, Three Arrows Capital, and Voyager Digital. Founder Do Kwon was arrested and faces fraud charges.
June 2021: Iron Finance (IRON/TITAN)
Loss: Approximately 2 billion dollars in total locked value went to zero within 24 hours.
Mechanism: IRON is partially collateralized by 75% USDC and 25% its native token TITAN. It offers yield incentives of up to 1700% annualized.
Trigger: Large redemptions lead to the sale of TITAN, causing a price collapse, which in turn destroys the collateral basis of IRON.
Lesson: Under pressure, partially collateralizing and relying on one's own volatile tokens as partial collateral is extremely dangerous.
March 2023: USDC
Decoupling: USDC briefly fell to $0.87 due to $3.3 billion in reserves being trapped in the collapsed Silicon Valley Bank.
Impact: Shook the market's absolute trust in “fully backed” fiat stablecoins. Triggered DAI (over 50% of its collateral is USDC) to decouple, resulting in over 3,400 liquidations on Aave, totaling 24 million dollars.
Lesson: Even the most trusted stablecoins face the systemic risks and dependencies of traditional financial systems.
November 2025: Stream Finance (xUSD)
Loss: Direct loss of 93 million USD, total risk exposure of the ecosystem is 285 million USD.
Mechanism: Recursive lending creates synthetic assets with no actual backing (leverage up to 7.6 times). 70% of the funds are managed by anonymous external managers through opaque off-chain strategies.
Current situation: xUSD trading price is between 0.07-0.14 USD, liquidity is depleted, withdrawals are frozen, facing multiple lawsuits. Elixir has been shut down.
Summary of common failure modes:
Unsustainable Returns: Terra (19.5%), Iron (1700% APR), Stream (18%).
Lack of transparency: Concealing subsidy costs, hiding off-chain operations, and doubts about reserve assets.
Weak collateral structure: partial collateral or reliance on volatile tokens can easily lead to a death spiral under pressure.
Oracle Manipulation: Distorted price inputs lead to incorrect liquidations and accumulation of bad debts.
The conclusion is clear: stablecoins are not stable; they only appear stable before a collapse, which could happen in just a few hours.
Oracle failure and infrastructure collapse
As the Stream crash began, the issues with oracles became painfully evident. When the market price of xUSD had fallen to $0.23, many lending protocols hardcoded their oracle price at $1.00 or higher in an effort to prevent cascading liquidations. This well-intentioned decision, however, led to a serious disconnection between protocol behavior and market reality. This hardcoding was an active policy choice, not a technical failure. Many protocols adopted a manual update approach for oracle prices to avoid triggering liquidations during temporary market fluctuations. However, when the price drop reflects the project's substantial insolvency, this approach can have disastrous consequences.
The agreement faces a difficult choice:
Using real-time prices: may face risks of market manipulation and triggering chain liquidations during volatility (the October 2025 event proved to be costly).
Using delayed prices or time-weighted average prices: cannot promptly reflect the real insolvency situation, leading to the accumulation of bad debts (for example, in the Stream event, the oracle showed $1.26 while the actual price was $0.23, resulting in $650,000 in bad debts for MEV Capital).
Using manual updates: Introduced centralized decision-making and risks of human intervention, which may even cover up the truth of insolvency by freezing prices.
All three methods have led to losses of hundreds of millions to even billions of dollars.
Infrastructure capacity under pressure
As early as October 2020, Harvest Finance experienced a $24 million attack that triggered a bank run, causing the total locked value to plummet from $1 billion to $599 million. The lessons learned from the collapse of its infrastructure were already very clear: the oracle system must consider the infrastructure's capacity under extreme stress events; the liquidation mechanism must have rate limits and circuit breaker mechanisms; exchanges must reserve redundant capacity for traffic ten times greater than normal. However, the events of October 2025 proved that this lesson has still not been heeded at the institutional level. When thousands of accounts face liquidation simultaneously, when billions of dollars in positions are liquidated within an hour, and when the order book becomes blank due to all buy orders being exhausted and the system overloaded unable to accept new orders, the failure of infrastructure is as complete as the failure of the oracle. Technical solutions to address these issues do exist, but they are often not implemented because they would reduce efficiency during normal operations and increase costs (affecting profits).
Core Warning
If you cannot identify the source of your profits, then you are not the recipient of those profits; you are, in fact, the cost of someone else's gains. This principle is not complicated, yet billions of dollars continue to flow into “black box” strategies, as people tend to believe the comforting lies rather than confront the unsettling truths. The next Stream Finance may very well be in operation right now.
Stablecoins are not stable.
Decentralized finance is often neither fully decentralized nor secure.
Revenue from unknown sources is not profit, but an asset transfer with a countdown.
These are not personal opinions, but well-documented experiential facts that have been repeatedly verified at a great cost. The only question is: will we ultimately act based on these known lessons, or would we rather pay another $20 billion in tuition to relearn them? History seems to lean towards the latter.
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
The recent frequent depegging of stablecoins: the industry has not learned lessons from history.
Written by: YQ
Compiled by: AididiaoJP, Foresight News
The stablecoin crisis in the first two weeks of November 2025 exposed the fundamental flaws in the decentralized finance (DeFi) sector that scholars have warned about for years. The collapse of Stream Finance's xUSD, along with the subsequent chain reaction of failures involving Elixir's deUSD and numerous other synthetic stablecoins, is far from an isolated case of mismanagement. These events reveal deep-seated structural issues within the DeFi ecosystem regarding risk management, transparency, and trust.
What I observed in the Stream Finance collapse is not a clever exploitation of smart contract vulnerabilities, nor a traditional oracle manipulation attack. Instead, it reveals a more disturbing fact: beneath the glamorous rhetoric of 'decentralization', fundamental financial transparency has already been lost. When an external fund manager can incur a loss of $93 million without any effective oversight, triggering a cross-protocol chain reaction of up to $285 million; when the entire 'stablecoin' ecosystem loses 40% to 50% of its total locked value in a week, despite seemingly maintaining its peg, we must acknowledge a basic fact about the state of decentralized finance: this industry has learned nothing.
To be more precise, the current incentive structure rewards those who ignore historical lessons, punishes those who act with caution and conservativeness, and shifts the losses to the entire market when an inevitable collapse occurs. An old saying in finance is particularly relevant and harsh here: if you don’t know where the returns come from, then you are the source of the returns yourself. When certain protocols promise an 18% return through opaque strategies, while the yields in mature lending markets are only 3% to 5%, the high yield is likely the principal of the depositors.
The operating mechanism and risk transmission of Stream Finance.
Stream Finance positions itself as a yield optimization protocol, offering up to 18% annual returns on users' USDC deposits through its interest-bearing stablecoin xUSD. Its claimed strategies include terms like “Delta neutral trading” and “hedge market making,” which sound esoteric, but the actual operation is vague. In comparison, Aave offers an annual yield of about 4.8% for USDC deposits, while Compound is slightly higher at 3%. Basic financial knowledge tells us to be cautious of returns that are several times above the market average; however, users have still deposited hundreds of millions into the protocol. Before the collapse, the trading price of 1 xUSD reached as high as 1.23 USDC, showcasing its compound returns. At its peak, xUSD claimed to manage assets totaling $382 million, but data from DeFiLlama indicates that its peak total locked value was only $200 million, meaning that over 60% of the so-called assets existed in unverifiable off-chain positions.
After the collapse, Yearn Finance developer Schlagonia revealed its true mechanism: it is a systemic fraud disguised as financial innovation. Stream adopted a recursive lending model, creating synthetic assets without actual value support through the following process:
User deposits USDC.
Stream exchanges USDC for USDT through CowSwap.
Use these USDT to mint deUSD on Elixir (Elixir is chosen because it offers high yield incentives).
Cross-chain these deUSD to networks like Avalanche and deposit them into the lending market to borrow more USDC, completing a loop.
As a result, although this strategy has become complex and relies on cross-chain operations, it can still be considered a form of collateralized lending. However, Stream has not stopped there. It did not use the borrowed USDC solely to expand the collateral loop but instead minted xUSD again through its StreamVault contract, which caused the supply of xUSD to far exceed the actual value of the collateral held. With only 1.9 million dollars of verifiable USDC as collateral, Stream minted up to 14.5 million xUSD, inflating the scale of synthetic assets by 7.6 times relative to the underlying reserves. This is akin to a fractional reserve banking system without reserves, regulation, or a lender of last resort.
Its circular dependency with Elixir makes the entire structure precarious. During the expansion of the xUSD supply, Stream deposited 10 million USDT into Elixir, thereby increasing the supply of deUSD. Elixir then exchanged this USDT for USDC and deposited it into Morpho's lending market. By early November, the supply of USDC on Morpho exceeded 70 million, with borrowing exceeding 65 million, and Elixir and Stream were the main participants. Stream holds about 90% of the total supply of deUSD (approximately 75 million), while a significant portion of Elixir's reserve assets comes from loans provided to Stream through a private Morpho vault. These two stablecoins are essentially mutually collateralized, meaning a loss for one results in a loss for the other. This “financial cycle” inevitably leads to systemic fragility.
Industry analyst CBB pointed out the problem as early as October 28: “xUSD has about 170 million dollars of on-chain assets as support, but they borrowed about 530 million dollars from lending protocols. This is a leverage of 4.1 times and is built on many illiquid positions. This is not yield farming at all; it is a gambler's risk.” Schlagonia had also warned the Stream team 172 days before the collapse, stating that it would only take five minutes to check their positions to see that the collapse was inevitable. These warnings were public, specific, and accurate, yet they were ignored by users chasing high yields, curators eager for fee income, and various protocols supporting the structure.
When Stream announced on November 4 that an external fund manager had lost about $93 million in fund assets, the platform immediately suspended all withdrawals. Due to the lack of an effective redemption mechanism, panic spread instantly. Holders rushed to sell xUSD in the illiquid secondary market. Within a few hours, the price of xUSD plummeted 77% to about $0.23. This stablecoin, which once promised stability and high returns, evaporated three-quarters of its value in a single trading day.
Specific data on risk transmission
According to the report from the DeFi research institution Yields and More (YAM), the direct debt exposure related to Stream amounts to 285 million USD throughout the ecosystem. Key parties involved include:
TelosC: Facing a loan risk of $123.64 million due to accepting Stream assets as collateral (the largest single risk exposure).
Elixir Network: Borrowed $68 million through private Morpho vault (65% of deUSD reserves).
MEV Capital: Risk exposure of 25.42 million USD, of which approximately 650,000 USD has become bad debt (due to the oracle freezing its price at 1.26 USD when the market price of xUSD dropped to 0.23 USD).
Others: Varlamore ($19.17 million), Re7 Labs (one vault $14.65 million, another vault $12.75 million), as well as institutions like Enclabs, Mithras, TiD, and Invariant Group holding smaller positions.
Euler: Facing approximately $137 million in bad debts.
A total of over $160 million in funds has been frozen across various protocols.
Researchers point out that this list is not exhaustive and warn that “there are likely more stablecoins or vaults affected,” as the full picture of risk transmission remains unclear weeks after the collapse.
Elixir's deUSD plummeted 98% from $1.00 to $0.015 within 48 hours due to 65% of its reserves being concentrated in loans to Stream through the private Morpho vault, becoming the fastest major stablecoin failure case since the Terra UST collapse in 2022. Elixir facilitated redemptions for about 80% of deUSD holders (excluding Stream itself), allowing them to exchange at a 1:1 ratio for USDC, thereby protecting most community users, but this protective measure came at a huge cost, with losses being passed on to protocols like Euler, Morpho, and Compound. Subsequently, Elixir announced it would completely shut down all stablecoin products, acknowledging that market trust had been irreparably destroyed.
The broader market reaction shows a systemic loss of confidence. According to data from Stablewatch, within a week of the Stream collapse, yield-bearing stablecoins as a whole lost 40% to 50% of their total locked value, although most still maintained their peg to the dollar. This means that around $1 billion in funds flowed out from protocols that did not fail and did not experience technical issues. Users are unable to distinguish between quality projects and fraudulent ones, and thus choose to flee all similar products. The total locked value in DeFi dropped by about $20 billion at the beginning of November. The market is pricing in the risk of a widespread chain reaction, rather than just the failure of specific protocols.
October 2025: $60 million triggered chain liquidation
Less than a month before the collapse of Stream Finance, the cryptocurrency market experienced another catastrophic crash. On-chain forensic analysis indicates that this was not an ordinary market downturn, but a precision attack initiated at an institutional scale that exploited known vulnerabilities. From October 10 to 11, 2025, a carefully orchestrated market sell-off worth $60 million triggered oracle failures, leading to a chain reaction of large-scale liquidations across the entire DeFi ecosystem. This was not a case of over-leveraged liquidations due to positions being underwater, but rather a reiteration of the oracle system's design flaws at the institutional level, repeating attack patterns that have been recorded and disclosed multiple times since February 2020.
The attack began at 5:43 UTC on October 10, with $60 million worth of USDe being concentrated and sold off into the spot market of a single exchange. In a well-designed oracle system, the impact of such localized selling pressure would be absorbed by multiple independent price sources with time-weighted average price mechanisms, thereby minimizing manipulation risk. However, the actual oracle system adjusted the value of the related collateral (wBETH, BNSOL, and USDe) in real-time based on the spot price of the manipulated trading venue. A large-scale liquidation was triggered immediately. The system's infrastructure was overwhelmed, and millions of simultaneous liquidation requests exhausted the system's processing capacity. Market makers were unable to quickly submit buy orders due to interruptions in the API data stream and a backlog of withdrawal requests. Market liquidity was instantly depleted. A chain reaction formed a vicious cycle.
Attack techniques and historical precedents
The oracle faithfully reported the manipulated prices that appeared at a single trading venue, while prices in all other markets remained stable. Major exchange data showed that USDe fell to $0.6567 and wBETH dropped to $430. Prices in other venues deviated by less than 0.3% from normal levels. The liquidity pools of on-chain decentralized exchanges were minimally affected. As pointed out by Ethena founder Guy Young, “over $9 billion in stablecoin collateral was readily available for redemption” throughout the event, proving that the underlying assets themselves were not impaired. However, the oracle reported manipulated prices, and the liquidation system executed based on these prices, ultimately leading to the destruction of numerous positions based on valuations that did not exist in the market.
This is exactly the pattern that led to Compound being severely hit in November 2020: at that time, DAI's trading price on Coinbase Pro soared to $1.30 for one hour, while other markets remained at $1.00, resulting in $89 million in liquidations. The trading venue changed, but the vulnerability remained. This type of attack is similar to the method that destroyed bZx in February 2020 (stealing $980,000 by manipulating Uniswap oracles), the same as the method that severely impacted Harvest Finance in October 2020 (stealing $24 million by manipulating Curve prices and triggering a $570 million liquidity crisis), and consistent with the multi-exchange manipulation attack in October 2022 that caused Mango Markets to lose $117 million.
According to statistics, between 2020 and 2022, there were a total of 41 oracle manipulation attacks, resulting in losses of up to $403.2 million. The industry's response has been slow and scattered, with most platforms continuing to use oracle solutions that heavily rely on spot prices and lack sufficient redundancy. The amplification effect of these attacks highlights the importance of learning from these lessons as the market scales. In the 2022 Mango Markets incident, a $5 million manipulation led to a loss of $117 million, amplifying it by 23 times. In the October 2025 incident, a $60 million manipulation triggered a chain reaction with a significant amplification effect. The methods of attack have not become more sophisticated; rather, the underlying systems still possess the same fundamental vulnerabilities while the scale has increased.
Historical Pattern: Failed Cases from 2020 to 2025
The collapse of Stream Finance is neither a first nor an isolated case. The DeFi ecosystem has experienced multiple failures of stablecoins, each time revealing similar structural vulnerabilities. However, the industry continues to repeat the same mistakes, with each instance growing in scale. The recorded failures over the past five years exhibit a highly consistent pattern:
Unsustainable high yields: Algorithms or partially collateralized stablecoins offer returns far above market levels to attract deposits.
Suspicious source of income: High returns are usually subsidized by token issuance or new inflow deposits, rather than real business income.
Excessive leverage and opacity: The operation of the protocol implies high leverage, and the actual collateral rate is unclear.
Circular dependency: the assets of Protocol A support Protocol B, while the assets of Protocol B in turn support Protocol A, creating a fragile closed loop.
Collapse triggers: Once any shock occurs that exposes its insolvent nature, or when subsidies become unsustainable, a bank run will happen.
Death Spiral: Users panic and withdraw, collateral value plummets, chain liquidations occur, and the entire structure collapses within days or even hours.
Risk transmission: The collapse spreads to other protocols that accept the stablecoin as collateral or are associated with its ecosystem.
Typical Case Review:
May 2022: Terra (UST/LUNA)
Loss: Approximately $45 billion in market value evaporated within three days.
Mechanism: UST is an algorithmic stablecoin that maintains its peg through the minting and burning mechanism of LUNA. The Anchor Protocol provides an unsustainable 19.5% yield for UST deposits.
Trigger: Large-scale UST redemptions and sell-offs led to decoupling, resulting in LUNA hyperinflation and death spiral.
Impact: Led to the bankruptcy of several major crypto lending platforms such as Celsius, Three Arrows Capital, and Voyager Digital. Founder Do Kwon was arrested and faces fraud charges.
June 2021: Iron Finance (IRON/TITAN)
Loss: Approximately 2 billion dollars in total locked value went to zero within 24 hours.
Mechanism: IRON is partially collateralized by 75% USDC and 25% its native token TITAN. It offers yield incentives of up to 1700% annualized.
Trigger: Large redemptions lead to the sale of TITAN, causing a price collapse, which in turn destroys the collateral basis of IRON.
Lesson: Under pressure, partially collateralizing and relying on one's own volatile tokens as partial collateral is extremely dangerous.
March 2023: USDC
Decoupling: USDC briefly fell to $0.87 due to $3.3 billion in reserves being trapped in the collapsed Silicon Valley Bank.
Impact: Shook the market's absolute trust in “fully backed” fiat stablecoins. Triggered DAI (over 50% of its collateral is USDC) to decouple, resulting in over 3,400 liquidations on Aave, totaling 24 million dollars.
Lesson: Even the most trusted stablecoins face the systemic risks and dependencies of traditional financial systems.
November 2025: Stream Finance (xUSD)
Loss: Direct loss of 93 million USD, total risk exposure of the ecosystem is 285 million USD.
Mechanism: Recursive lending creates synthetic assets with no actual backing (leverage up to 7.6 times). 70% of the funds are managed by anonymous external managers through opaque off-chain strategies.
Current situation: xUSD trading price is between 0.07-0.14 USD, liquidity is depleted, withdrawals are frozen, facing multiple lawsuits. Elixir has been shut down.
Summary of common failure modes:
Unsustainable Returns: Terra (19.5%), Iron (1700% APR), Stream (18%).
Circular dependency: UST-LUNA, IRON-TITAN, xUSD-deUSD.
Lack of transparency: Concealing subsidy costs, hiding off-chain operations, and doubts about reserve assets.
Weak collateral structure: partial collateral or reliance on volatile tokens can easily lead to a death spiral under pressure.
Oracle Manipulation: Distorted price inputs lead to incorrect liquidations and accumulation of bad debts.
The conclusion is clear: stablecoins are not stable; they only appear stable before a collapse, which could happen in just a few hours.
Oracle failure and infrastructure collapse
As the Stream crash began, the issues with oracles became painfully evident. When the market price of xUSD had fallen to $0.23, many lending protocols hardcoded their oracle price at $1.00 or higher in an effort to prevent cascading liquidations. This well-intentioned decision, however, led to a serious disconnection between protocol behavior and market reality. This hardcoding was an active policy choice, not a technical failure. Many protocols adopted a manual update approach for oracle prices to avoid triggering liquidations during temporary market fluctuations. However, when the price drop reflects the project's substantial insolvency, this approach can have disastrous consequences.
The agreement faces a difficult choice:
Using real-time prices: may face risks of market manipulation and triggering chain liquidations during volatility (the October 2025 event proved to be costly).
Using delayed prices or time-weighted average prices: cannot promptly reflect the real insolvency situation, leading to the accumulation of bad debts (for example, in the Stream event, the oracle showed $1.26 while the actual price was $0.23, resulting in $650,000 in bad debts for MEV Capital).
Using manual updates: Introduced centralized decision-making and risks of human intervention, which may even cover up the truth of insolvency by freezing prices.
All three methods have led to losses of hundreds of millions to even billions of dollars.
Infrastructure capacity under pressure
As early as October 2020, Harvest Finance experienced a $24 million attack that triggered a bank run, causing the total locked value to plummet from $1 billion to $599 million. The lessons learned from the collapse of its infrastructure were already very clear: the oracle system must consider the infrastructure's capacity under extreme stress events; the liquidation mechanism must have rate limits and circuit breaker mechanisms; exchanges must reserve redundant capacity for traffic ten times greater than normal. However, the events of October 2025 proved that this lesson has still not been heeded at the institutional level. When thousands of accounts face liquidation simultaneously, when billions of dollars in positions are liquidated within an hour, and when the order book becomes blank due to all buy orders being exhausted and the system overloaded unable to accept new orders, the failure of infrastructure is as complete as the failure of the oracle. Technical solutions to address these issues do exist, but they are often not implemented because they would reduce efficiency during normal operations and increase costs (affecting profits).
Core Warning
If you cannot identify the source of your profits, then you are not the recipient of those profits; you are, in fact, the cost of someone else's gains. This principle is not complicated, yet billions of dollars continue to flow into “black box” strategies, as people tend to believe the comforting lies rather than confront the unsettling truths. The next Stream Finance may very well be in operation right now.
Stablecoins are not stable.
Decentralized finance is often neither fully decentralized nor secure.
Revenue from unknown sources is not profit, but an asset transfer with a countdown.
These are not personal opinions, but well-documented experiential facts that have been repeatedly verified at a great cost. The only question is: will we ultimately act based on these known lessons, or would we rather pay another $20 billion in tuition to relearn them? History seems to lean towards the latter.