The chain began producing blocks on Crypto.com-linked Cronos network stopped on Sunday, 30 August, after validators uncovered an exploit in Tectonic, the network’s biggest lending protocol. Cronos said it detected the attack and paused the chain while it looked into the issueintroducing a freeze across the whole network instead of limiting the suspension to one application. According on-chain researcher Weilin Li, the attacker exploited TONIC, the thinly traded governance token for Tectonic, to pump the token around 100-fold within about 20 minutes.
“Deployed the peg for TONIC, the Tectonic governance token, to drive its value up by around x100 across approximately 20 minutes” the protocol, he said. “Posted these inflated tokens as collateral so that they could borrow other assets from the protocol. I saw this as similar to the 2022 Mango Markets attack” before the attack, Tectonic’s token TONIC had very low daily volume and Tectonic’s own documentation noted that low-liquidity assets can be attacked in this way.
It had a collateral factor of 20% which meant that “for every dollar in accepted TONIC value there would be, in theory, around twenty cents of borrowing power”. Li initially valued affected assets at approximately $66 million, but then increased his valuation to approximately $75 million when he discovered a second attacker-controlled address holding approximately $8 million. Meanwhile PeckShield, a security company, valued affected assets at roughly $74 million. Only roughly $6 million was bridged to Ethereum before validators halted the chain and most of the stolen proceeds became stranded on Cronos. A second analysis, this one tracking gross outflows from Tectonic’s pools, calculated the total to be about $119.5 million.
As of the time of writing, Tectonic itself had yet to confirm a final loss amount or root cause. Before the attack, Tectonic had approximately $121.7m TVL in total and approximately $82.7m worth of live loans, approximately 50% of all Cronos DeFi capital. By Monday these deposits were down to approximately $3m. Pioneering researchers also noted liquidations and copycat activity during the live TONIC price manipulation. Crypto.
com claimed its app and exchange weren’t affected and offered security team assistance for the investigation. Cronos was able to recover relatively quickly in part because its validator set is relatively small. Validators eventually brought the chain back to the pre-exploit state and continued producing blocks, deleting the intermediate blocks so as not to blow out the lion’s share of the proceeds that were stored on chain.
The apparently bridged-to-Ethereum funds were outside of this rollback. The network announced it would post a comprehensive postmortem, even as its services, explorers and bridges were still coming back online. The incident contributed to the year to date record of how many attacks on DeFi systems have involved price manipulation.
