Cronos Says $9.19M Escaped Tectonic Exploit Before Network Halt
Cronos has released its post-mortem on the Tectonic exploit, revealing that around $120.4 million in borrowing was linked to manipulated collateral prices, while $9.19 million in assets moved off the Cronos network before validators could intervene.
According to the report published Tuesday, Cronos’ rollback restored roughly $111.2 million of the affected funds by returning the blockchain to its state before the attack. That left about 7.6% of the exploited value outside the network and unable to be recovered through the rollback.
The official figures provide a clearer picture of the incident, which was initially estimated to involve around $75 million. The $9.19 million transferred away from Cronos also exceeds the $8.3 million that blockchain intelligence firm Bitquery had previously tracked moving to Ethereum.
The attack centered on Tectonic, a decentralized lending protocol on Cronos. One transaction was used to drain nine lending markets through 11 transfers involving stablecoins, Bitcoin, Ether and other assets.
Bitquery’s analysis found that the attacker initially deposited about $5 million before repeatedly borrowing and redepositing TONIC in a looping strategy. The process was carried out roughly 98 times while the attacker accumulated the thinly traded token.
As the buying activity pushed TONIC’s market price sharply higher, its value reportedly increased nearly 300-fold. Tectonic’s price oracle then reflected the inflated market price, allowing the attacker to use the manipulated TONIC valuation as collateral for significantly larger loans.
Tectonic identified the suspicious activity at 12:49 UTC on Aug. 30. Cronos validators responded by halting the network at 14:32:47 UTC, stopping further block production while the incident was investigated and balances were reconstructed.
Network activity eventually resumed at 23:49:01 UTC after Cronos restored account balances to their pre-exploit state.
The post-mortem gives users and the wider crypto industry a more precise breakdown of the damage. While most of the affected funds were recovered through the rollback, the $9.19 million that left the network remains outside the scope of that intervention.