Overview of the Cronos Exploit
The blockchain network Cronos has reported that $9.19 million of funds remains unaccounted for following a major exploit that involved a $120.4 million breach related to the Tectonic lending protocol. An analysis by Cronos, released Monday, detailed how the attacker successfully manipulated the value of TONIC, Tectonic’s governance token, allowing them to borrow excessively from nine different lending markets.
Details of the Attack
The attack occurred on August 30, prompting Cronos validators to initiate a shutdown of the network at block number 90,907,150. After deliberation, they decided to revert the network to block 90,896,188, which marked the final state before the exploit began. This rollback effectively reversed around $111.2 million of the affected funds, restoring balances to their previous condition. However, the $9.19 million that had been withdrawn from the network before the halt is unfortunately lost and cannot be reclaimed.
Rollback and Transaction History
According to the report, the rollback erased nearly 11,000 blocks, amounting to roughly one hour and fifty-four minutes of transaction history. This action reversed all transactions within that timeframe, irrespective of their link to the Tectonic incident.
Decision-Making Process
Cronos communicated that the validators faced a challenging decision concerning whether to prioritize transaction finality or mitigate further financial loss. They stated,
“It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk. The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.”
Financial Impact and Analysis
Notably, earlier analyses had significantly underestimated the attack’s financial impact. Initial reports estimated about $75 million had been involved according to on-chain researcher Weilin Li, who found that most of the assets were still within the Cronos ecosystem when the blockchain ceased operations. Later assessments by Bitquery confirmed the total withdrawal from Tectonic reached $120.4 million, a figure corroborated by the findings in Cronos’ post-mortem.
Mechanics of the Attack
The incident unfolded as the attacker deployed contracts to artificially inflate the price of TONIC, which was then used as collateral to secure the large loans. Remarkably, the reported value of TONIC surged approximately 100 times within about twenty minutes, enabling the theft. The token allowed for a collateralization ratio of 20%, permitting users to borrow against a portion of their TONIC value. RedStone co-founder Marcin Kazmierczak highlighted that the oracle responsible for reporting prices had not failed; rather, Tectonic inadequately assessed whether the liquidity existed to sell the collateral at the inflated values.
Aftermath and Broader Implications
Before the attack, Tectonic was managing around $121.7 million in total locked value with nearly $82.7 million in active loans. The aftermath of the malicious activity saw Cronos halting network transactions approximately 36 minutes after the exploit commenced, initiating an investigation to mitigate further damage. The network resumed normal operations approximately 11 hours later, following the rollback.
Despite gaining back much of the stolen funds, the $9.19 million loss is now part of a larger trend in cryptocurrency loss during August, where security firm PeckShield reported a total of $136.3 million was compromised across various hacks. Overall, this event emphasizes the need for enhanced safeguards in decentralized finance protocols. The investigation and reconciliation processes with exchanges and affected systems continue as stakeholders monitor the recovery efforts.
