DeFi protocols lose $83 million in attacks using a strategy regulators targeted

Malicious actors attacked Tectonic and Moonwell using variations of a price-manipulation strategy that US regulators had previously targeted. The attacks were described as causing $83 million in reported losses. The body estimated combined losses at over $84 million. GoPlus estimated that roughly $75 million was affected at Tectonic on Cronos. The Tectonic attacker appears to have exploited TONIC, a relatively thinly traded token that could be deposited as collateral. GoPlus described the attack as a price-manipulation and over-borrow operation. The attacker repeatedly looped collateral and borrowing positions while pushing TONIC sharply higher within minutes. Tectonic assigned TONIC a collateral factor of about 20%. Every $100 of recognized collateral could support roughly $20 in borrowing. The manipulated holdings eventually represented about $375 million in collateral value. GoPlus estimated that value created roughly $75 million in potential borrowing capacity. The attacker used the expanded credit line to withdraw USDT. The attacker also withdrew other liquid assets. Cronos halted block production to contain the incident. About $6 million had already been bridged to Ethereum. Those funds were swapped into roughly 2,600 ETH. The halt prevented the remaining affected assets from moving across the network. As of Monday morning, Cronos remained halted while it investigated the exploit with help from security teams across the industry. Cronos had not disclosed when operations would resume. Tectonic had not published a final accounting of its losses. Moonwell's MAMO market on Base was attacked three days earlier, on Aug. 27. The attacker began with about $1.95 million in USDC. The attacker accumulated more than 94 million MAMO tokens. The attacker transferred about 53 million MAMO into Moonwell's mMAMO collateral contract without minting additional shares. That action increased the amount of underlying MAMO represented by each existing share by roughly 3.7 times. MAMO's market price rose from about $0.0106 to $0.4313. The price increase and share change raised the value that Moonwell recognized for the attacker's collateral. The attacker completed 18 borrows totaling roughly $11 million. The borrowed assets included cbBTC, WETH, USDC, and wstETH. Liquidations began 32 seconds after the final borrow. Moonwell was left with about $9.1 million in residual borrower obligations. SlowMist separately estimated losses at roughly $8.7 million. SlowMist identified reliance on pricing from a thin MAMO market as the root vulnerability. The attacks followed a broader strategy of using an illiquid asset to create collateral value. Attackers then converted that inflated valuation into borrowing power against deeper pools of capital. Mango Markets provided a prominent precedent in October 2022. Avraham Eisenberg built positions linked to MNGO before buying the thinly traded token on exchanges that supplied prices to the platform. MNGO's reported value rose more than 13-fold in about 30 minutes. Eisenberg then used the inflated positions as collateral to withdraw more than $110 million in digital assets from Mango Markets. The CFTC described the operation as a manipulative and deceptive scheme. The CFTC called the case its first involving a strategy commonly known as oracle manipulation on a decentralized digital-asset platform. The SEC filed a parallel action alleging that Eisenberg artificially increased MNGO's price. The SEC alleged that he used the resulting collateral valuation to borrow and withdraw about $116 million. The recurring weakness involves lending systems that allow thinly traded assets to support borrowing limits far greater than the liquidity needed to move their prices. Automatically adjusting collateral limits can give a manipulated market access to larger pools of liquid assets.