- A hacker exploited a leading lending protocol on the Cronos chain, but independent validators detected it quickly and froze the network mid-attack.
- Compromised assets are estimated at around $75 million.
- Most of the stolen assets are frozen, but sources claim the attacker had already bridged approximately $6 million on Ethereum.
- The perpetrator pumped Tectonic’s TONIC tokens and used their inflated prices to borrow against Cronos’ native token CRO.
Cronos Stops All Network Activities
On Sunday at noon (UTC), Cronos (CRO), a chain built and supported by Crypto.com, paused all network operations. It did so after discovering an ongoing attack on Tectonic, a leading decentralized protocol in its ecosystem.
Crypto.com confirmed the incident but declined to disclose the amount lost. Yet various crypto news platforms projected the compromised assets at roughly $75 million.
Independent validators’ quick response halted the culprit’s transfer of $69 million in compromised funds. However, the perpetrator managed to bridge the rest to Ethereum (ETH).
Crypto.com assured users that its app and exchange were unaffected. Meanwhile, it said its security team is already investigating the case.
For now, Tectonic advises users not to interact with its decentralized finance (DeFi) platform.
How the Hacker Carried Out the Attack
According to reports, the attacker took advantage of Tectonic’s (TONIC) thin liquidity. The perp pumped the token by around 39,140% in less than half an hour.
Following that, the hacker used the inflated tokens to bootstrap the scheme. The attacker used them to borrow millions of dollars worth of other crypto assets.
Status of Tectonic and Cronos
As of early Monday morning, TONIC remains frozen at $0.00000002960 after climbing from $0.00000001066 to $0.000004183 over the last 24 hours. The latter also represented its all-time high.
On the other hand, Tectonic’s Total Value Locked (TVL) fell dramatically. It went from $121.58 million before the incident’s discovery to $3 million in its immediate aftermath.
Cronos reflected only an approximately 11% drop from $0.05589 to $0.06282 over the last 24 hours. The freeze in block production mainly kept further crashes at bay.
Nonetheless, the chain’s TVL dipped sharply. It slid from $264.15 million to $203.91 million over the same period.
Cronos is assessing several measures for its asset recovery. Furthermore, it’s studying whether to restart the network by rolling back to its state before the attack while blocking the attacker’s address, or to carry over the imprint of the incident.
The fate of the frozen compromised tokens weighs heavily on its next move.
