DeFi Protocols Hit with Over $83 Million in Losses from Price-Manipulation Attacks
Financial regulators have been warning about this type of attack for months, but decentralized finance (DeFi) protocols Tectonic and Moonwell were recently targeted with over $83 million in losses.
The larger incident hit Tectonic on the Cronos blockchain, where security firm GoPlus estimated roughly $75 million was affected. The attacker exploited the protocol's treatment of TONIC, a relatively thinly traded token that could be deposited as collateral and used to support borrowing.
GoPlus described the incident as a price-manipulation and over-borrow attack in which the attacker repeatedly looped collateral and borrowing positions while pushing TONIC sharply higher within minutes. The attacker then used that expanded credit line to withdraw USDT and other liquid assets.
A token trading in a shallow market can sometimes be moved substantially with comparatively little capital, while lending contracts may use that elevated price to calculate borrowing limits against pools holding significantly more valuable assets.