tectonic

Cronos confirmed in a post-mortem report that the attack on the lending platform Tectonic on August 30 involved $120.4 million in borrowing activities. The validators made the "difficult decision" to roll back the on-chain history, successfully recovering approximately $111.2 million (about 92% of the affected funds), while about $9.19 million flowed out before the network was paused and could not be recovered. The attacker leveraged weak DEX liquidity to inflate the price of Tectonic token TONIC by about 100 times within minutes and borrowed $120.4 million through a single transaction across nine markets. The validators paused the network about two hours later, restoring the chain to the last block before the suspicious activity, with block production resuming approximately 11 hours after the attack. The rollback involved reversing 1 hour and 54 minutes of on-chain history, totaling 10,961 blocks, with all transactions within that window being canceled, regardless of whether they were involved in the attack. Cronos stated that the alternative would have been to restart the network without restoring the previous state, which would have left the stolen assets in the hands of the attacker. This rollback closely followed Harmony's announcement of a similar plan, while Flow abandoned its rollback proposal last December due to community opposition. The validator cap for Cronos is 100, which facilitated quick coordination for the pause and restart, but also indicated that the network's finality in emergencies depends on validator consensus.

Cronos lending protocol Tectonic released an attack incident report on August 30: the attacker manipulated the TONIC price by approximately 195 times and looped collateral, borrowing about $120.4 million from 9 lending markets. After Cronos paused the network and restored the status, most assets returned to their pre-attack state, but about $9.19 million has been transferred across chains and has not yet been recovered.The team plans to eliminate low liquidity collateral and set a market borrowing limit.

According to market news, the Tectonic attacker marked address has deposited 2,658.9 ETH (approximately 6.65 million USD) into TornadoCash.

The Cronos network has resumed and restarted block production after pausing operations to protect users from the vulnerabilities of the Tectonic protocol. A complete post-incident analysis report will be released soon.

Cronos Network officially announced that the network has resumed block production and is fully operational again. Previously, Cronos paused block production due to a vulnerability exploitation incident involving the Tectonic protocol, and validators took emergency consensus measures to protect user funds, rolling back the chain state to before the Tectonic vulnerability exploitation on August 30.The network has resumed block production at UTC time August 30, 23:49:01 from block height 90,896,189. Cronos stated that node operators can now restart their nodes using Cronos v1.7.8 and the latest mainnet snapshot.The network is currently under continuous monitoring, and some protocols, RPC service providers, block explorers, and cross-chain bridges are expected to take longer to recover. Cronos stated that the team will release a complete event review report after confirming network stability.

The Cronos network associated with Crypto.com has paused operations after detecting an attack on the lending protocol Tectonic. The Cronos Network stated on the X platform that it has identified vulnerabilities on Tectonic and has paused the network. Tectonic also confirmed that it is investigating the related incident and advised users not to interact with the protocol until safety is confirmed. According to DefiLlama data, Tectonic had a total locked value of approximately $121.7 million before the incident, with active loans of about $82.7 million.On-chain researcher Weilin Li attributed the attack to price manipulation of the TONIC token. The attacker bought enough TONIC within 20 minutes to inflate its price by about 100 times, and then used the inflated tokens as collateral to borrow other assets from Tectonic, a method similar to the 2022 Mango Markets oracle manipulation attack. Li initially estimated that the attacker profited about $66 million, and later discovered another address controlled by a different attacker containing about $8 million, bringing the total estimate to around $75 million. Li also stated that the attacker only successfully bridged about $6 million to Ethereum, as the pause on the Cronos network prevented most affected assets from flowing out.Crypto.com CEO Kris Marsalek stated that the company's app and exchange were not attacked, and its security team is assisting Tectonic with the investigation.