DeFi lenders getting rekt like clockwork. This time it's Tectonic and Moonwell – $84M gone in 4 days ($75M from Tectonic on Cronos, $9.1M from Moonwell on Base). The playbook is so old the CFTC already sued someone for it back in 2022 (Mango Markets, ring a bell?). But nah, let's keep accepting illiquid shitcoins as collateral. What could go wrong?
▪️ Tectonic attacker throws in $600k, buys 16 trillion TONIC from three pools with the liquidity of a kiddie pool. Price shoots 40x in minutes. Easy money.
▪️ Deposits that pumped TONIC as collateral. Protocol sees $375M in 'value' and lets him borrow $75M+ in real shit – stablecoins, BTC, ETH, CRO. Smooth move.
▪️ Cronos validators panic and freeze the chain. Only $6M got bridged to Ethereum before the freeze; $60M+ is still stuck onchain while they debate a rollback. Democracy in action, I guess.
▪️ Moonwell attacker starts with $1.95M USDC, bags 94M MAMO, then dumps 53M into the mMAMO contract. No minting needed – share value inflates 3.7x. Beautiful in its simplicity.
▪️ MAMO price goes from $0.01 to $0.43. Attacker borrows $11M across 18 loans. Liquidations trigger 32 seconds after the last borrow – but $9.1M in bad debt sticks. Retail gets the bill as usual.
▪️ Both exploits share the same root cause: pricing off a spot market so shallow even a retail whale can move it. If you have $600k, you can own the oracle. Nice system.
📊 Total drained:
$84M+📊 Tectonic loss:
$75M📊 Moonwell loss:
$9.1M📊 Trapped on Cronos:
$60M+Two identical heists in four days? That's not a bug, it's a feature. Your precious TONIC or MAMO collateral is worth exactly what the next guy with a few hundred grand decides it's worth. Cronos freezing the chain? Sure it 'saved' some funds, but it also proved validators can pull the kill switch anytime they feel like. Centralization: fixes one problem, invents another.
💬 «Nothing here was 'hacked.' No key was stolen, no lock was picked. Tectonic did exactly what it was built to do — it read a price off a thin pool and believed it. If your protocol reads spot price directly from a market someone can move, that price is for sale.» — Awoo, industry observer
🔮 DeFi lenders still using spot prices from pools with $2 in liquidity. What could possibly go wrong? Yeah, we already know.
@exverse_chat
