DeFi lending beyond stablecoin rules: Two-minute price error triggers $3 million in liquidations

Two minutes of incorrect price data on Vesu liquidated 47 loan positions worth roughly $3 million in September, highlighting lending risks that stablecoin issuer regulation does not address.

In its “The GENIUS Act's guarantees don't cover DeFi lending” report published on November 11, 2026, CoinDesk cited the incident as an example of the gap between protections for stablecoin holders and risks in decentralized finance lending. Reserve requirements at the issuer level do not prevent faulty pricing or changes to lending terms in markets receiving those tokens, the report argued.

Issuer reserve rules leave lending risks unresolved

The Federal Reserve recently proposed two rules to implement the GENIUS Act. They would require stablecoin issuers to hold reserve assets backing their tokens and meet new capital and risk-management standards. Issuers must honor redemptions within two business days and report outstanding stablecoins monthly.

The act takes effect on January 18, 2027, or 120 days after final rules are issued, whichever comes first. CoinDesk said publicly available standards could support broader national-level uses for stablecoins, including debt servicing and wider dollar use. Lending markets receiving those stablecoins, however, still have weaknesses to address.

In a typical onchain lending market, an oracle supplies the prices used to determine when loans are liquidated. Token holders vote on changes to market rules, sometimes after loans have been made. The report argued that these safeguards, taken together, can concentrate control among a small number of decision-makers.

Shared risk management can spread pricing errors

Curated vaults and standardized oracle feeds have made DeFi easier to access, according to CoinDesk. Institutions can assess a vetted selection of markets, evaluate a single counterparty and review risks in terms familiar to their credit committees. That addresses an early obstacle in DeFi, where depositors were expected to manage risks themselves despite often lacking the expertise.

The same concentration can transmit failures across markets. When a small group of risk managers and price feeds supports billions in loans, an incorrect setting or brief price spike can trigger liquidations wherever the same infrastructure is used, including markets unrelated to the original error, the report said.

In November 2025, Stream Finance suffered a $93 million loss. Analysts traced about $285 million in possible exposure across Euler, Silo, Morpho and other markets. In February, a Moonwell governance vote configured a feed that priced Coinbase Wrapped Staked ETH (cbETH) at about $1.12 instead of roughly $2,200, leaving about $1.78 million in bad debt.

In March, outdated settings in an Aave risk tool undervalued Lido’s wrapped staked ether (wstETH) by about 2.85%, triggering approximately $27 million in liquidations. September’s Vesu incident then liquidated 47 positions after just two minutes of faulty prices. CoinDesk presented the cases as evidence that a single bad input can cause substantial losses.

Changing loan terms complicate institutional underwriting

The report argued that DeFi is recreating a problem of excessive interconnectedness without the capital buffers being required of stablecoin issuers. Institutional lenders assess credit against contractual terms; governance votes that can subsequently alter collateral rules, liquidation thresholds or interest rates make that assessment difficult.

Credit teams cannot reliably model contracts that token holders may rewrite after lending, CoinDesk argued. Externally managed infrastructure, including oracles, can also fail or become unavailable. The report called for markets whose terms cannot be changed by a centralized authority.

Published standards for stablecoin issuers would bring full reserves, capital buffers and redemption within two business days to dollars moving onchain, the report said. Those protections stop short of the lending markets receiving the funds. A fully backed stablecoin can still enter a loan governed by changeable rules or be valued using a feed that supplies incorrect prices for two minutes.