Valinity Hack

Valinity, an Ethereum lending protocol, lost about $63,000 in early January 2026 through a business-logic flaw in how it rebalanced its VY token. VY is a synthetic, reserve-backed asset that users can post as collateral to borrow BTC, ETH and PAXG.

Anyone could call acquireByLTVDisparity(), which rebalanced VY holdings using LTV ratios and Uniswap V3 spot prices. It was hardcoded to sell VY into a nearly empty liquidity pool holding only about $106 of USDC. The attacker first pushed the PAXG price up with a USDC-to-PAXG swap, then called the rebalancer, which dumped VY into the tiny pool at a terrible price. The attacker bought that cheap VY and used it as collateral to borrow ETH, BTC and PAXG, then left with the loans. The analyst who published the first breakdown argued this was not simple price manipulation, because the attacker raised the price of an asset instead of lowering the price of the loan token.

TxRay's reconstruction of one exploit transaction found that the rebalancing call minted about 3.96 × 10^25 VY (roughly 39.6 million VY) and raised the PAXG cap before the VY was used as loan collateral, taking out about 22.12 ETH-equivalent. Valinity paused its contracts by disabling borrowing, which blocked any repeat of the attack.