TL;DR
- KuCoin and other DeFi platforms are grappling with a 2026 marked by 32 price manipulation exploits, a historical record according to TRM Labs.
- The most prominent case was the Tectonic exploit on August 30: an attacker inflated the price of TONIC roughly 100 times in 20 minutes and borrowed approximately $75 million.
- Price manipulation now accounts for one in every eight crypto hacks, up from one in every 17 in 2022. Some $972 million was stolen in the first half of the year.
Decentralized finance (DeFi) is going through its worst year in terms of security, particularly regarding price manipulation. According to TRM Labs data, 32 exploits of this type were recorded during 2026, more than in any previous full year. That figure is crucial considering that DeFi is a sector where exchanges like KuCoin and lending protocols accumulate tens of billions of dollars in locked value, and where code security is no longer enough to protect users.
One of the most controversial cases occurred recently, on August 30, when an attacker manipulated the price of the TONIC token, the governance token of the Tectonic protocol, built on Cronos. In approximately 20 minutes, the price was inflated roughly 100 times. The attacker deposited that asset as collateral and borrowed approximately $75 million in liquid assets. In the week prior to the exploit, TONIC had recorded just $305,000 in trading volume. The amount extracted was equivalent to roughly 245 times that weekly volume.
Vulnerabilities in DeFi Lending
The logic behind these attacks does not require breaching the code of a smart contract. Instead, it targets the economic assumptions underlying the DeFi lending market: specifically, that collateral can be valued and liquidated at the price the protocol observes on-chain. If a token with real liquidity of $100,000 can be artificially inflated until the protocol values it at $10 million, a 60% loan factor would generate borrowing capacity of several million dollars in genuinely liquid assets.
Other DeFi protocols suffered similar situations. Moonwell recorded an exploit on August 27 of approximately $8.7 million linked to MAMO collateral. Rhea Lend lost $18.4 million in April due to spot price manipulation. Bonzo Lend, for its part, suffered a different case in July: the attacker did not move the real SAUCE market, but instead sent a fake price update, inflated by approximately 12 orders of magnitude, which was accepted due to a flaw in oracle verification, resulting in the extraction of $9.05 million.
Why Low-Liquidity Collateral Causes More Damage
Three characteristics, when they coincide, make a DeFi protocol especially vulnerable: low collateral liquidity, generous lending parameters, and high borrowing capacity. A governance token or a newly launched asset can be far cheaper to manipulate than Bitcoin or Ethereum, whose market depth makes any distortion attempt costly.
The response of Cronos to the Tectonic exploit opened another debate: validators halted block production and rolled back the chain to a state prior to the attack, recovering approximately $68.7 million that had remained on the network. Only around $6 million had reached Ethereum before the intervention. The measure was effective in terms of recovery, but sparked a discussion about transaction finality and the limits of governance in networks that present themselves as decentralized.
