CryptoSlate
Tectonic on Cronos and Moonwell on Base lost a combined $84 million in four days to variations of the same price-manipulation strategy that regulators pursued against Mango Markets exploiter Avraham Eisenberg in 2022.
On Cronos, security firm GoPlus estimated roughly $75 million was drained from Tectonic through a repeated loop of depositing and borrowing against the thinly traded TONIC token, whose market price was pushed sharply higher within minutes. Cronos halted block production to contain the incident, though about $6 million had already been bridged to Ethereum and swapped into roughly 2,600 ETH.
Three days earlier on Base, Moonwell's MAMO market was left with about $9.1 million in residual debt after an attacker accumulated more than 94 million MAMO tokens, pushed the market price from $0.0106 to $0.4313, and used the inflated valuation as collateral to borrow roughly $11 million in cbBTC, WETH, USDC, and wstETH across 18 transactions.
Why it matters
The Tectonic and Moonwell incidents replay the Mango Markets playbook with mechanical precision. In October 2022, Eisenberg built positions linked to MNGO before aggressively buying the thinly traded token on venues feeding prices into the platform. MNGO's reported value rose more than 13-fold in about 30 minutes, and the inflated collateral backed withdrawals of more than $110 million. The CFTC labeled the operation a 'manipulative and deceptive scheme' and called it the agency's first involving oracle manipulation on a decentralized platform. The SEC filed a parallel action alleging $116 million in borrower losses.
Three-plus years after those enforcement actions, both attacks show the underlying economics have not been re-engineered out of the affected lending systems. Lending contracts continue to recognize collateral whose price can be moved with capital orders of magnitude smaller than the borrowing limit that price unlocks.
Market impact
For Tectonic, the attack turned TONIC's 20% collateral factor into a $375 million collateral valuation that unlocked roughly $75 million of borrowing capacity against deeper pools of USDT and other liquid assets.
Frequently asked questions
-
How did the Tectonic attacker drain $75M from Cronos?
The attacker repeatedly looped deposits and borrows against TONIC, a thinly traded token with a 20% collateral factor at Tectonic. By pushing TONIC's market price sharply higher within minutes, the attacker inflated recognized collateral to about $375M and withdrew roughly $75M in USDT and other liquid assets before…
-
What was the Moonwell MAMO exploit on Base?
On August 27, an attacker accumulated more than 94 million MAMO tokens, transferred 53 million directly into Moonwell's collateral contract to inflate share value, and pushed MAMO's market price from $0.0106 to $0.4313. The attacker then borrowed about $11 million in cbBTC, WETH, USDC, and wstETH across 18…
-
Why are regulators calling this a known vulnerability?
The CFTC and SEC both prosecuted Avraham Eisenberg after the 2022 Mango Markets exploit, where a thin token (MNGO) was pumped to inflate collateral and drain over $110 million. The Tectonic and Moonwell attacks use variations of the same economic strategy, suggesting lending systems have not been re-engineered to…
-
How does oracle manipulation work in DeFi lending?
Lending protocols use price oracles to value deposited collateral and set borrowing limits. If the collateral is a thinly traded token, an attacker can move its market price with relatively small capital. The lending contract then recognizes the inflated price as collateral worth far more, unlocking borrowing capacity…
-
Is the Cronos blockchain still halted?
As of Monday morning, Cronos said the chain remained halted while it investigated the Tectonic exploit with industry security teams. Roughly $6 million had already been bridged to Ethereum and swapped into about 2,600 ETH before the halt contained the remaining affected assets. The network has not disclosed a…
TheBlock
CoinDesk
WuBlockchain