DeFi lending protocols lost more than $84 million in two separate attacks over four days this week, with both exploits leaning on the same weakness: illiquid tokens used to inflate collateral and borrow against deeper pools. The bigger hit landed on Tectonic, a lending market on Cronos, which lost roughly $75 million. Moonwell on Base lost about $9.1 million in residual debt after an attack on its MAMO market.
The Tectonic exploit
The attacker manipulated the price of TONIC, Tectonic's native token, to inflate collateral and borrow against it. Cronos halted block production to contain the damage, and about $6 million was bridged to Ethereum before the pause. The halt bought the protocol time, but the money was already gone.
How Moonwell fell
On Moonwell, the attacker used 53 million MAMO tokens to inflate collateral, pushing the price from $0.0106 to $0.4313. They then executed 18 borrows totaling roughly $11 million. Liquidations began 32 seconds after the final borrow, but they left $9.1 million in residual debt. SlowMist estimated the losses at approximately $8.7 million, a figure that conflicts with the residual debt number. The protocol hasn't reconciled the gap.
The Mango Markets parallel
The playbook is familiar. It's the same strategy Avraham Eisenberg used against Mango Markets in October 2022, when he manipulated the MNGO price and withdrew over $110 million. US regulators — the CFTC and SEC — pursued Eisenberg in early 2023, describing the strategy as oracle manipulation. The attacks this week are a reminder that the technique still works.
The recurring weakness
The through-line is thin liquidity. When a token's price feed rests on a shallow market, a single large order can move it far enough to borrow against assets the attacker doesn't actually have. That's the weakness regulators flagged in the Eisenberg case, and it's still here. The open question is the Moonwell number. The protocol says $9.1 million in residual debt; SlowMist says $8.7 million. Until that's reconciled, the final bill for the week is somewhere north of $84 million.
