Two decentralized lending protocols, Tectonic and Moonwell, suffered over $83 million in losses after attackers exploited thinly traded tokens to inflate collateral values and drain liquid assets
Two decentralized finance (DeFi) lending protocols, Tectonic and Moonwell, have suffered a combined loss of more than $83 million after attackers manipulated the price of illiquid tokens to extract funds. The incidents, which unfolded over a four-day period, highlight persistent vulnerabilities in DeFi lending markets that rely on thinly traded assets as collateral.
Tectonic Exploit on Cronos
The larger of the two attacks targeted Tectonic, a lending protocol operating on the Cronos blockchain. According to security firm GoPlus, the attacker exploited the protocol's handling of TONIC, a token with limited trading activity. By repeatedly looping deposits and borrows while aggressively buying TONIC, the attacker artificially drove up its price within minutes. Tectonic's system, which assigned TONIC a 20% collateral factor, automatically increased the attacker's borrowing capacity as the token's price rose. GoPlus estimated that the manipulated position reached a notional collateral value of $375 million, enabling the attacker to borrow and withdraw approximately $75 million in liquid assets such as USDT.
This exploit took advantage of a structural weakness: when a protocol uses the market price of a thinly traded token to set borrowing limits, a determined actor can inflate collateral value with relatively little capital. Once the buying pressure subsides and the token price collapses, the protocol is left with undercollateralized loans and drained reserves. In response, Cronos halted block production to prevent further asset movement, but GoPlus reported that about $6 million had already been bridged to Ethereum and converted to roughly 2,600 ETH. As of Monday morning, Cronos remained offline while the incident was under investigation, and Tectonic had not yet released a final loss report.
Moonwell's MAMO Market Attack
Just three days before the Tectonic exploit, Moonwell's MAMO lending market on Base was targeted in a related attack. The perpetrator began with $1.95 million in USDC and acquired over 94 million MAMO tokens. By transferring 53 million MAMO directly into Moonwell's mMAMO collateral contract-without minting new shares-the attacker increased the value of each share by 3.7 times. Simultaneously, MAMO's market price surged from $0.0106 to $0.4313, sharply boosting the recognized collateral value. The attacker then executed 18 borrows totaling about $11 million in cbBTC, WETH, USDC, and wstETH. Despite rapid liquidations, Moonwell was left with $9.1 million in residual debt. Security firm SlowMist attributed the vulnerability to reliance on thin MAMO market pricing, estimating losses at $8.7 million.
Recurring DeFi Vulnerabilities
While the technical details differed, both attacks followed a familiar pattern: using an illiquid token to artificially inflate collateral value, then borrowing against that inflated position to drain more liquid assets. This strategy echoes the 2022 Mango Markets incident, where a similar price manipulation led to over $110 million in losses and subsequent regulatory action by the Commodity Futures Trading Commission and Securities and Exchange Commission. The persistence of these exploits underscores the risks of allowing thinly traded tokens to serve as collateral in DeFi lending protocols.
For context, the ongoing debate over digital asset regulation and market structure in the U.S. has been shaped by high-profile incidents like these. As policymakers consider new rules, the challenges of managing collateral risk in decentralized systems remain unresolved, as discussed in recent coverage of crypto policy uncertainty.
Market Impact and Data
According to GoPlus, the Tectonic exploit resulted in approximately $75 million in affected assets, while Moonwell's incident left $9.1 million in residual borrower obligations. The attacks occurred between August 27 and August 31, 2026. Cronos halted block production in response to the Tectonic attack, and about $6 million was bridged to Ethereum before the halt. Security firm SlowMist estimated Moonwell's losses at $8.7 million, with the root cause traced to the use of thin market pricing for collateral valuation.
Collateral price manipulation remains a critical risk in DeFi lending. When protocols accept illiquid tokens as collateral and automatically adjust borrowing limits based on market price, they become vulnerable to attacks that can drain substantial reserves. The events at Tectonic and Moonwell demonstrate that, despite past enforcement actions and increased scrutiny, DeFi protocols must address the structural weaknesses that allow these exploits to persist. For users and developers, understanding the mechanics of collateral valuation and liquidity risk is essential to navigating the evolving DeFi landscape.
