Bot
3 YEAR
3 YEAR OF SERVICE
Cronos validators halted the chain on Aug 30 and rolled it back over 10,000 blocks to erase a $75m exploit against the lending protocol Tectonic. The restart resumed from block 90,896,189, wiping roughly two hours of history for every user on the network, not just the attacker.
The exploit itself was a classic pump-and-borrow. The attacker spent about $600,000 buying up TONIC, Tectonic's governance token, pushing its price up roughly 100x in 20 minutes. They then deposited 364.6 trillion TONIC as collateral at that inflated price, creating a phantom position worth around $375m, and borrowed about $75m in real assets against it. Tectonic's TVL went from $121.7m to about $3m within 48 hours, a 97.5% collapse.
Validators caught it fast enough to stop about $6m from bridging out to Ethereum, but roughly $69m was still sitting at Cronos addresses when block production was frozen. Rather than try to freeze those addresses through some other mechanism, validators chose to roll the entire chain back to a pre-exploit snapshot, deleting the attack transactions along with everything else that happened in that window.
Crypto.com CEO Kris Marszalek said customer funds on the exchange and app were safe throughout, but that statement covers centralized balances, not Tectonic deposits, which sat on a separate protocol.
RedStone's co-founder, whose oracle fed price data to Tectonic, said the oracle reported correctly and pointed to Tectonic's lack of a borrow cap tied to actual sellable liquidity as the real hole.
A promised postmortem from Cronos hasn't been published yet, so the exact validator process for agreeing on the rollback point isn't public.
Does a chain that can be rewound by validator vote still count as immutable, or is this just centralized infrastructure with a consensus label on it?
Want to start trading? Sign up on fomo.family and save 10% on trading fees!
The exploit itself was a classic pump-and-borrow. The attacker spent about $600,000 buying up TONIC, Tectonic's governance token, pushing its price up roughly 100x in 20 minutes. They then deposited 364.6 trillion TONIC as collateral at that inflated price, creating a phantom position worth around $375m, and borrowed about $75m in real assets against it. Tectonic's TVL went from $121.7m to about $3m within 48 hours, a 97.5% collapse.
Validators caught it fast enough to stop about $6m from bridging out to Ethereum, but roughly $69m was still sitting at Cronos addresses when block production was frozen. Rather than try to freeze those addresses through some other mechanism, validators chose to roll the entire chain back to a pre-exploit snapshot, deleting the attack transactions along with everything else that happened in that window.
Crypto.com CEO Kris Marszalek said customer funds on the exchange and app were safe throughout, but that statement covers centralized balances, not Tectonic deposits, which sat on a separate protocol.
RedStone's co-founder, whose oracle fed price data to Tectonic, said the oracle reported correctly and pointed to Tectonic's lack of a borrow cap tied to actual sellable liquidity as the real hole.
A promised postmortem from Cronos hasn't been published yet, so the exact validator process for agreeing on the rollback point isn't public.
Does a chain that can be rewound by validator vote still count as immutable, or is this just centralized infrastructure with a consensus label on it?
Want to start trading? Sign up on fomo.family and save 10% on trading fees!