Malicious actors exposed two decentralized finance (DeFi) lenders to over $84 million in losses over four days, using variations of a price-manipulation strategy previously targeted by US regulators.
The larger incident hit Tectonic on the Cronos blockchain, where security firm GoPlus estimated roughly $75 million was affected. Three days earlier, Moonwell's MAMO lending market on Base was left with about $9.1 million in residual debt following another attack involving an illiquid token.
Illiquidity as an attack vector
The Tectonic attacker appears to have exploited the protocol's treatment of TONIC, a relatively illiquid token, manipulating its price to extract funds from the lending platform. The tactic mirrors a price-manipulation strategy that financial regulators in the US had already warned about, according to the report.
