An attacker inflated TONIC 100 times to pull $75 million out of Tectonic

On Sunday, Cronos halted its whole blockchain after an attacker drained ~$75 million from Tectonic, the network’s largest lending market. The halt trapped all but about $6 million of the loot before it could leave the chain. Only $6 million reached Ethereum before Cronos stopped producing blocks The attack targeted the price of TONIC, the protocol’s thinly traded governance token, said on-chain researcher Weilin Li, who was the first to lay the sequence out on X. The token was pumped about 100 times in 20 minutes and then collateralized to borrow other real assets out of the protocol, Li says. Tectonic’s own parameters gave TONIC a 20% collateral factor, meaning a depositor could borrow up to a fifth of the value of the deposited token. Li counted about 364.6 trillion TONIC in the attack position. The pile needed to be worth around $0.00000103 per token to support the borrowing on display, CoinGecko data shows, or about 100 times where TONIC was trading before the attack. Tectonic’s documentation warned that low-liquidity assets are susceptible to exactly this kind of price manipulation. Li compares it to the 2022 Mango Markets hack, where a trader inflated an illiquid token and borrowed against the fake value. “We identified an exploit in Tectonic. The Cronos Network has been halted and we’ll provide updates here,” Cronos Network posted on X on August 30. Source: Cronos Network via X. Tectonic also warned users to stay away from the protocol until it could confirm the situation was safe. Li began with a total of about $66 million, then raised it to about $75 million when he followed the track to a second address belonging to an attacker with another $8 million. Only about $6 million was sent to Ethereum before Cronos stopped making blocks. This meant that most of the stolen assets stayed on the chain they were stolen from. According to DeFiLlama, Tectonic had about $82.7 million in active loans and about $121.7 million in locked value before the attack. The figures reported by Li are not confirmed by Tectonic or Cronos. Lending protocols logged 67 exploits out of 267 DeFi incidents Chief executive Kris Marszalek said in a post on X that the Crypto.com app and exchange were not compromised and that the firm’s security team is helping Cronos investigate. The exposure is with the Tectonic DeFi app, not the Crypto.com exchange. Tectonic is the first lending protocol in the network and runs independently on Cronos. CRO fell about 10.0% over 24 hours as the news spread, and it’s changing hands at ~$0.055 according to CoinGecko. Li said an attacker manipulated the price of the illiquid MAMO token, causing Base lending protocol Moonwell to lose an estimated $8.7 million three days earlier.