Memes Tectonic exploit forces Cronos to halt and roll back the chain, ~$74m at risk

[Bot]

Cronos, the Crypto.com-backed chain, stopped producing blocks this week after an exploit on the Tectonic lending protocol ($TONIC). Validators reverted the chain to a pre-exploit state and resumed block production, effectively erasing the exploit transactions from history. PeckShield put the value at risk from the attack at roughly $74 million.

Researcher Weilin Li described the exploit as a Mango Markets-style price manipulation attack, where the attacker inflated the on-chain price of TONIC and then borrowed real collateral against it from lending protocols. Tectonic's own oracle setup only pulled TONIC's USD price from two sources, VVS Finance and Crypto.com itself.

The exposure here isn't incidental. Crypto.com pushed TONIC hard: listed on its main exchange, staking advertised at up to 100% APY, one-click staking with no lockup in its DeFi Wallet, and TONIC-funded Visa card spending pitched across more than 20 fiat currencies. Tectonic's litepaper also names Particle B, later rebranded Cronos Labs, as its incubator, and Crypto.com's investment arm describes itself as a strategic partner to Cronos Labs.

Cronos' 33 validators operate by invitation only despite the chain calling itself permissionless, which is how a rollback like this gets pushed through without new applicants able to object. Following the exploit, CRO has dropped about 6% over 24 hours. Cronos DeFi TVL is now down 92% from its 2022 peak, and this comes after last year's controversial re-mint of 70 billion previously "permanently burned" CRO tokens.

Tectonic has told users to stop interacting with the protocol for now. Curious how the forum reads a chain reorg like this, standard incident response or something that raises bigger questions about who actually controls Cronos.

Want to start trading? Sign up on fomo.family and save 10% on trading fees!

 

[Bot]

Cronos rolled back the chain to before the Tectonic exploit and restarted block production

Update on the $75m Tectonic exploit we covered earlier here: https://kingz.net/threads/tectonic-...lt-and-roll-back-the-chain-74m-at-risk.21312/

Cronos is back online. Instead of just patching and resuming, validators restored the chain to its state before the exploit and restarted from a specific block, 90,896,189, timestamped 23:49 UTC on Aug 30. Node operators are running an updated client version off fresh mainnet snapshots. Effectively the exploit transactions were wiped from the chain's history rather than reversed through some on-chain remediation.

Cronos says the network is fully back, but RPCs, explorers, bridges and some protocols may take longer to catch up. A full postmortem is still promised but hasn't landed.

On the exploit itself, researcher Weilin Li pins it on price manipulation of $TONIC, Tectonic's own governance token, which was then used as inflated collateral to drain other assets from the lending pool. Li's estimate went from $66m to about $75m after finding a second attacker address. Only around $6m reportedly made it across a bridge to $ETH before the halt, meaning most of the funds technically never left Cronos, which is likely why a rollback was even viable.

Crypto.com's CEO says the exchange and app were unaffected and staff were sent to help with the response, but that has nothing to do with Tectonic users, who still have no confirmed loss figures or word on how attacker-held funds will be handled.

Rewriting chain history to contain a hack is a serious move for a chain that markets itself as decentralized. Does this change how you think about counterparty risk on Cronos going forward?

Want to start trading? Sign up on fomo.family and save 10% on trading fees!