Two DeFi lenders lose over $83 million in price manipulation attacks

Two decentralized finance (DeFi) lending platforms, Tectonic and Moonwell, lost a combined $83 million in separate attacks that used price manipulation of thinly traded tokens to inflate collateral values and drain funds.

DeFi, short for decentralized finance, refers to financial services like lending and borrowing that run on blockchain technology without traditional banks.

Over $83 million lost in two separate incidents

Tectonic, operating on the Cronos blockchain, suffered the larger loss, with security firm GoPlus estimating around $75 million affected. The attack involved manipulating the price of TONIC, a token with low trading volume, to artificially increase its value as collateral. This allowed the attacker to borrow large amounts of stablecoins and other liquid assets from the protocol.

Three days earlier, Moonwell’s MAMO lending market on the Base network lost about $9.1 million in a similar attack. The attacker used a small initial investment to accumulate a large amount of MAMO tokens, then inflated their price to boost collateral value before borrowing roughly $11 million in assets like cbBTC, WETH, USDC, and wstETH. Moonwell was left with $9.1 million in unpaid debt after liquidations began.

How the attacks worked

In both cases, attackers exploited the low liquidity of certain tokens. By buying large amounts of these tokens, they drove up their prices sharply in a short time. Since the DeFi protocols used these inflated prices to calculate collateral value, the attackers could borrow far more than the actual worth of their deposits.

For Tectonic, the attacker’s manipulated TONIC holdings were valued at about $375 million in collateral, allowing them to borrow roughly $75 million in liquid assets. Cronos halted its blockchain to stop further movement of funds, but about $6 million had already been moved to Ethereum and converted into 2,600 ETH. As of August 31, Cronos remained halted while investigations continued.

Moonwell’s attack involved transferring 53 million MAMO tokens directly into its collateral contract, increasing the value of each share by about 3.7 times. The price of MAMO surged from $0.0106 to $0.4313, enabling the attacker to borrow heavily before the protocol could respond.

Regulators had warned about this risk

These attacks follow a pattern seen in the 2022 Mango Markets exploit, where a trader manipulated the price of the MNGO token to borrow and withdraw over $110 million. US regulators, including the Commodity Futures Trading Commission (CFTC) and the Securities and Exchange Commission (SEC), later described this as a “manipulative and deceptive scheme” and took legal action.

The recurring issue is that DeFi lending systems can assign high borrowing power to tokens that trade in shallow markets, where prices are easy to manipulate with relatively small amounts of capital.

What happens next

Cronos has not announced when its blockchain will resume operations. Tectonic has not yet released a final accounting of its losses. Investigations are ongoing with help from multiple security teams.

Sources

• CryptoSlate