Tectonic exploit drains $6M from Crypto.com-linked Cronos blockchain before validators pull the emergency brake

A DeFi lending protocol built on Crypto.com’s Cronos blockchain got taken for roughly $75 million on August 30, after an attacker manipulated the price of a governance token to borrow assets far exceeding its real value. About $6 million made it off the chain before validators shut everything down. The target was Tectonic, the largest decentralized lending protocol on Cronos. How the attack worked According to on-chain researcher Weilin Li, the attacker pumped the price of TONIC, Tectonic’s governance token, by approximately 100x in roughly 20 minutes. With TONIC’s value artificially bloated, the attacker deposited the token as collateral on Tectonic’s lending platform. TONIC carried a 20% collateral factor, meaning for every dollar of TONIC deposited, you could borrow 20 cents of other assets. The attacker then borrowed over $74 million worth of other tokens against the inflated collateral. Li’s estimate puts total losses from the exploit at around $75 million. Approximately $6 million was successfully bridged to Ethereum before Cronos validators coordinated to halt block production on the network. The remaining assets, valued at somewhere between $60 million and $69 million, were...