DeFi protocols lose $83 million in price‑manipulation attacks

Two DeFi lending platforms suffered combined losses of more than $83 million after attackers exploited thinly traded tokens to inflate collateral values and borrow large amounts of liquid assets.

Attack on Tectonic (Cronos)

The larger incident hit Tectonic on the Cronos blockchain. Security firm GoPlus estimated roughly $75 million was affected. The attacker manipulated the price of TONIC, a low‑volume token that could be used as collateral. By repeatedly looping collateral and borrowing positions while driving TONIC’s price sharply higher, the attacker increased the protocol‑assigned collateral value to about $375 million, giving a borrowing capacity of roughly $75 million. The borrowed assets, including USDT, were withdrawn before the market corrected.

Cronos halted block production, but about $6 million had already been bridged to Ethereum and swapped into roughly 2,600 ETH. The network remains halted pending investigation.

Attack on Moonwell (Base)

Three days earlier, Moonwell’s MAMO lending market on Base was targeted. The attacker started with about $1.95 million in USDC, accumulated over 94 million MAMO tokens, and transferred 53 million MAMO directly into the collateral contract without minting new shares. This action inflated the value of each share by roughly 3.7 times while MAMO’s price rose from $0.0106 to $0.4313.

Using the inflated collateral, the attacker executed 18 borrows totaling about $11 million in cbBTC, WETH, USDC and wstETH. Liquidations began seconds after the final borrow, leaving Moonwell with approximately $9.1 million in residual borrower obligations. Security firm SlowMist estimated losses at roughly $8.7 million.

Regulatory context

The tactics mirror the October 2022 Mango Markets exploit, where thin‑token price manipulation was used to withdraw over $110 million. US regulators, including the CFTC and SEC, have previously labeled such schemes as manipulative and deceptive. The recent incidents show that similar vulnerabilities persist in DeFi lending protocols.