DeFi Protocols Fall Prey to Price-Manipulation Attacks

Two decentralized finance (DeFi) lending protocols, Tectonic and Moonwell, have suffered significant losses due to attacks that exploited their lending systems. The larger incident hit Tectonic on the Cronos blockchain, where security firm GoPlus estimated roughly $75 million was affected.

The attackers used a price-manipulation strategy previously targeted by US regulators, which involved using an illiquid token, TONIC, as collateral to support borrowing. The protocol assigned TONIC a collateral factor of about 20%, meaning every $100 of collateral recognized by the protocol could support roughly $20 in borrowing.

As TONIC's market price climbed, the value assigned to the attacker's position increased automatically. GoPlus estimated that the manipulated holdings eventually represented about $375 million in collateral value, translating into roughly $75 million of potential borrowing capacity. The attacker then used that expanded credit line to withdraw USDT and other liquid assets.

The trade exploited a fundamental imbalance, where a token trading in a shallow market can sometimes be moved substantially with comparatively little capital, while lending contracts may use that elevated price to calculate borrowing limits against pools holding significantly more valuable assets.