6 Recent Crypto Hacks: What Went Wrong and What They Teach Us

Across six recent incidents, roughly $99M in reported or affected value was involved. The attacks covered price manipulation, oracle manipulation, governance, organizational compromise, arbitrary external calls and arithmetic flaws.

#01 — Tectonic: ~$75M Affected

TONIC market · Lending · Price manipulation

An attacker pushed the thinly traded TONIC price roughly 100x in about 20 minutes. The inflated TONIC position was then used as collateral to borrow harder assets from Tectonic's lending pools.

About $75M was borrowed against the manipulated collateral. Cronos halted the chain shortly after the attack, and validators later rolled the chain back. Roughly $6M had reached Ethereum before the halt.

#02 — Moonwell: ~$8.7M

MAMO market · Oracle manipulation · Base

An attacker manipulated the MAMO market and the MAMO oracle while inflating the collateral position used in Moonwell's MAMO market. The manipulated pricing and collateral accounting allowed the attacker to borrow assets against collateral that did not represent its real market value. Moonwell's post-mortem identified the incident as a combination of collateral-accounting inflation and oracle-price manipulation.

#03 — Term Labs: ~$8.5M

Vaults · Governance takeover · No core vault-code exploit

The attacker acquired enough governance power to control Term Labs' Meta Vaults. A governance proposal was then used to disable the vault transaction delay and authorize withdrawals. Approximately 2,841.74 WETH and 1,679,639 USDC were withdrawn, worth about $8.5M at the time. The vault contracts executed the instructions that governance authorized.

#04 — Fogo Foundation: ~$3M

Foundation · Organizational compromise

The Fogo Foundation reported that its organization had been compromised and that an attacker received approximately 400 million FOGO tokens, worth around $3M at the time. The incident was described as an organization-level compromise rather than a failure of the Fogo blockchain itself. Fogo halted its mainnet while validators implemented measures to restrict movement of the affected assets.

#05 — Aquifer: ~$2.47M

Solana AMM · Arbitrary external call · Forged balance

An attacker exploited an arbitrary external-call path in Aquifer's Solana AMM. The attacker supplied a malicious token/account setup that caused the protocol to treat a fabricated balance as legitimate. The attacker then drained real assets from liquidity vaults across multiple settlements. Approximately $2.45M–$2.47M was removed.

#06 — Notional Finance: ~$1.73M

Legacy escrow · Arithmetic flaw · Integer overflow

Notional V1, a deprecated legacy product, was exploited through an arithmetic error in the mintfCashPair function. The attacker created an abnormally large debt position, bypassed a collateral check and transferred an unbacked collateral position to another account. Approximately 1.65M USDC and 69K DAI were stolen.

The Common Thread

These six incidents did not rely on one common vulnerability. They targeted different layers:

• Tectonic → market pricing and collateral assumptions
• Moonwell → oracle and collateral accounting
• Term Labs → governance and administrative controls
• Fogo Foundation → organizational security
• Aquifer → external calls and account validation
• Notional Finance → arithmetic and legacy contract logic

Why This Matters

A security review that only asks "Is the Solidity correct?" can miss important attack paths. Modern crypto systems depend on:

• Oracles
• Governance
• Wallets and administrative keys
• Third-party infrastructure
• External calls
• Market liquidity
• Legacy contracts
• Economic assumptions

An attacker does not always need to break the core code. Sometimes they only need to manipulate what the protocol trusts.

What Security Teams Should Review

• Price manipulation: Can a thin market move collateral prices enough to unlock excessive borrowing?
• Oracle design: Are price feeds resistant to manipulation and abnormal market conditions?
• Governance: Can voting power be cheaply concentrated or used to disable safety controls?
• Administrative security: Which organizational wallets and privileged accounts can move assets or change protocol behavior?
• External calls: Does every execution path validate the program, account and data it interacts with?
• Legacy code: Are old contracts still holding funds or allowing withdrawals? If yes, they remain part of the attack surface.

Final Takeaway

The six incidents show six different ways a protocol can fail. Not every exploit is a line-of-code bug. Some are failures of pricing. Some are failures of governance. Some are failures of access control. Some are failures of validation. And some are failures of arithmetic. The security boundary is therefore much larger than the contract itself.