An attacker inflated TONIC 100 times to pull $75 million out of Tectonic

On Sunday, Cronos halted its whole blockchain after an attacker drained ~$75 million from Tectonic, the network’s largest lending market.

The halt trapped all but about $6 million of the loot before it could leave the chain.

Only $6 million reached Ethereum before Cronos stopped producing blocks

The attack targeted the price of TONIC, the protocol’s thinly traded governance token, said on-chain researcher Weilin Li, who was the first to lay the sequence out on X.

The token was pumped about 100 times in 20 minutes and then collateralized to borrow other real assets out of the protocol, Li says.

Tectonic’s own parameters gave TONIC a 20% collateral factor, meaning a depositor could borrow up to a fifth of the value of the deposited token. Li counted about 364.6 trillion TONIC in the attack position.

The pile needed to be worth around $0.00000103 per token to support the borrowing on display, CoinGecko data shows, or about 100 times where TONIC was trading before the attack.

Tectonic’s documentation warned that low-liquidity assets are susceptible to exactly this kind of price manipulation.

Li compares it to the 2022 Mango Markets hack, where a trader inflated an illiquid token and borrowed against the fake value.

“We identified an exploit in Tectonic. The Cronos Network has been halted and we’ll provide updates here,” Cronos Network posted on X on August 30.

Tectonic also warned users to stay away from the protocol until it could confirm the situation was safe.

Li began with a total of about $66 million, then raised it to about $75 million when he followed the track to a second address belonging to an attacker with another $8 million.

Only about $6 million was sent to Ethereum before Cronos stopped making blocks. This meant that most of the stolen assets stayed on the chain they were stolen from.

According to DeFiLlama, Tectonic had about $82.7 million in active loans and about $121.7 million in locked value before the attack.

The figures reported by Li are not confirmed by Tectonic or Cronos.

Lending protocols logged 67 exploits out of 267 DeFi incidents

Chief executive Kris Marszalek said in a post on X that the Crypto.com app and exchange were not compromised and that the firm’s security team is helping Cronos investigate.

The exposure is with the Tectonic DeFi app, not the Crypto.com exchange. Tectonic is the first lending protocol in the network and runs independently on Cronos.

CRO fell about 10.0% over 24 hours as the news spread, and it’s changing hands at ~$0.055 according to CoinGecko.

Li said an attacker manipulated the price of the illiquid MAMO token, causing Base lending protocol Moonwell to lose an estimated $8.7 million three days earlier.

He also highlighted an August 25 episode where a thinly traded Pendle market was gamed into about $36 million of liquidations on leveraged PT-reUSD positions on Morpho.

Cryptopolitan reported in July an oracle attack on Balance Protocol that fed a bad price, which crashed the BLC token about 99% and drained about $912,000 from governance entity 42DAO.

In February, lending protocols logged 67 exploits over the past year out of 267 DeFi incidents. Price manipulation alone accounted for 13 attacks and resulted in about $65 million in losses.

Cronos hasn’t said when it will reboot the chain or what it will do with the attacker’s stranded assets.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.