Cronos Halts Blockchain After $75M Tectonic Price Manipulation Attack

• CRO-USD
• ETH-USD

• Cronos halted block production on Aug. 30 after an exploit hit Tectonic, the network’s largest lending protocol.

• Onchain researcher Weilin Li estimates the attacker manipulated TONIC’s price roughly 100-fold in 20 minutes before borrowing about $75 million against the inflated collateral.

• Only around $6 million reached Ethereum before the halt, while Crypto.com says its exchange, app and customer funds were not affected.

Cronos took the unusual step of halting its entire blockchain on Sunday, Aug. 30, after a suspected price manipulation attack targeted Tectonic, its largest decentralized lending protocol.

The attack affected an estimated $75 million, although neither Tectonic nor Cronos has confirmed the final loss or published a complete post-mortem.

Most of the suspected proceeds remained trapped on Cronos after validators stopped the network.

Before the incident, Tectonic held roughly $121.7 million in total value locked and $82.7 million in active loans. By Monday, its TVL had fallen to around $3 million

How the $75M Tectonic Attack Worked

The apparent weakness was not a conventional smart contract drain.

Onchain researcher Weilin Li said the attacker targeted TONIC, Tectonic’s thinly traded governance token, and pushed its price roughly 100 times higher within about 20 minutes.

The attacker then deposited the artificially inflated TONIC into Tectonic as collateral and borrowed higher-value assets against it.

That was possible because TONIC had a 20% collateral factor. In other words, every $100 of TONIC value recognized by the lending protocol could support approximately $20 of borrowing.

The risk was amplified by TONIC’s shallow market. Reportedly, the token had only about $1.34 million in liquidity and roughly $11,000 in daily trading volume, making its market price easier to move than a heavily traded asset.

Li initially estimated around $66 million had been affected before identifying another attacker-controlled address holding roughly $8 million, raising his estimate to approximately $75 million.

Cronos Halt Traps Most of the Funds

The attacker did not manage to move most of the assets away.

Li estimated that only about $6 million was bridged to Ethereum before Cronos stopped block production, leaving the majority of the suspected proceeds stranded on the chain.

That could improve the chances of recovering some assets, but it creates another difficult question: what Cronos validators do with the funds when the network restarts.

Source: finance.yahoo.com