The $120 million Tectonic hack that shut down Cronos

On the afternoon of 30 August, the people who run the Cronos blockchain did something networks are not supposed to be able to do. They switched it off.

Cronos is a blockchain backed by Crypto.com, and like most blockchains it is meant to keep producing blocks whether anyone approves of what is in them or not. That afternoon its validators agreed to stop, in the middle of a robbery, because stopping was the only way to keep the money from leaving. It worked. Most of it is still sitting there, frozen in place, in wallets that belong to whoever carried this out.

The target was Tectonic, the biggest lending market on the chain. A lending market is a pool of money other people deposited, which you can borrow from if you leave something valuable behind as security. Tectonic held about $122 million of deposits, by DefiLlama's count, close to half of everything on Cronos. By the time the chain stopped, its lending pools were empty.

Bitquery indexes Cronos, and our index runs to four seconds before the chain stopped. We pulled the transaction that emptied Tectonic and added up what it moved. It took 11 different assets, from dollar stablecoins to bitcoin to XRP, and they came to $120.4 million.

Then we followed the money. It left in three separate streams rather than one, through wallets that have not been named anywhere, and the amount that made it off the chain before the halt is larger than the figure in circulation. What follows is the whole route, asset by asset and wallet by wallet.

01How you rob a lending pool

Borrowing on a platform like Tectonic works the way a pawnshop does. You hand over something valuable, and you get to walk out with a fraction of what it is worth. Leave $100 of one token, borrow $80 of another. If your collateral falls too far in value, the platform sells it and settles up.

The whole thing rests on one point: the platform has to know what your collateral is worth. It learns that from a price feed, a piece of software that watches where the token trades and reports the number back. If you can move the price the feed is watching, you can make the platform believe your collateral is worth far more than it is, and borrow against a number you invented.

That is what happened here, and the token chosen for it was TONIC, Tectonic's own. TONIC is worth about a hundred-millionth of a dollar and barely trades, which is exactly why it was chosen. Moving its price took $1.4 million of borrowed money, and that was enough to move it by a factor of nearly 300.

The attacker deposited $5 million of real dollars, borrowed the entire supply of TONIC that Tectonic had, put it straight back in as collateral, and borrowed again. That loop ran 98 times inside a single transaction. By the end of it the collateral claim on record was about two thirds of every TONIC that exists.

Then they bought TONIC on the open market with money borrowed from Tectonic itself, and waited for the price feed to catch up. Over the next seven minutes the traded price rose to almost 300 times where it started, and the feed followed it up in steps.

02What the drain actually took

At 12:49:39 UTC the attacker made one call to their own contract. It emptied Tectonic's 11 lending markets, taking from each one exactly the cash it had available, down to the last unit.

Two of those 11 were the dollar stablecoins, and they were the bulk of it. They were split between two destinations, three quarters going to a plain wallet and a quarter to a contract. Those two assets alone came to $75.7 million, which is why a quick count of the obvious money lands well short of the real total.

The other nine legs went to that contract, which the attacker had deployed almost two weeks earlier. Bitcoin, ether, Crypto.com's own wrapped bitcoin and ether, staked CRO, wrapped CRO and XRP, plus the quarter-share of both stablecoins. Together they came to $44.7 million, spread across assets small enough to be easy to miss.

Tectonic's own books show the same thing from the other side. The cash held across its markets fell by about $119 million between the day before the attack and the halt. The biggest market, its USDC pool, was left holding three cents.

03Twelve days of practice

The contract that received those nine assets had been sitting on the chain since 18 August, twelve days before it was used. Creating it was the very first transaction the operator's wallet ever made on Cronos.

What it did over the following hours reads like a dry run. About $1,900 each of USDC, USDT, wrapped bitcoin, wrapped ether and wrapped CRO were walked through it, one asset at a time. That is the same set of assets the drain would later take, at roughly one twenty-thousandth of the scale.

Two days later they tested the way out. The contract sent a small amount of CRO to a second wallet, which pushed it through a cross-chain bridge in four equal batches and kept the change. The change is what funded the attack: on 24 August that wallet sent 12,800 CRO to the operator, and over the next few hours dealt small amounts of gas to every other address that would be used on the day.

None of this was subtle, and none of it was hidden. It was simply nine days early, on a chain nobody was watching that closely, in amounts too small to trip anything.

0411 minutes

At 12:38:56 UTC on 30 August the operator deployed two more contracts and ran the loop. That single transaction burned 33 million units of gas and emitted 677 events, which is an enormous amount of work to fit into one block.

Three follow-up transactions over the next seven minutes borrowed more money from Tectonic and spent it buying TONIC, feeding the price the feed was reading. The first of the three failed. They adjusted it and sent it again, which is worth noting, because it tells you the operation was being steered by hand and not simply fired off.

At 12:49:39 the drain went through. 11 minutes had passed since the first setup transaction, and Tectonic's lending markets were empty.

05Three ways out, and a deadline nobody announced

Getting money off a blockchain you have just robbed is harder than taking it. The attacker used a bridge, a service that accepts your money on one chain and pays you an equivalent amount on another. Three separate streams went through it.

The one everybody reported is the stablecoins. Around $6.3 million of USDC reached Ethereum between 13:03 and 14:15, and every cent of it was swapped into ether within the hour. That wallet has 2,592 ether in it now and has not touched it since.

The second stream is the one that has gone unreported, and it is the more interesting of the two. The vault contract spent the hour after the drain selling its odds and ends, the staked CRO, the XRP, the ether, the bitcoin, into whatever pools on Cronos would take them. It turned the proceeds into ordinary CRO and pushed it out through the same bridge in 28 batches.

The last batch cleared at 14:31:24. Cronos stopped at 14:32:47. The attacker was still moving money 83 seconds before the network went dark, and that final batch was still paid out on the other side.

A third, smaller stream moved $200,000 of USDT through a wallet that has not been named anywhere either. All three streams paid out to addresses on Ethereum that we can match back to the Cronos side, because the same wallet addresses were used on both chains and each payment landed within twenty seconds of the batch that triggered it.

06What the halt caught

The decision to stop the chain saved most of the money. Not all of it.

About $111 million is frozen on Cronos, and the largest single piece of it is not sitting in a wallet at all. Roughly $60 million was deposited into a liquidity pool on VVS Finance, a trading venue on the chain, which is why anyone scanning that address for tokens finds it empty. It holds three quarters of that pool.

What got out is $8.1 million, spread across four wallets on Ethereum rather than one. Most of the attention has gone to the stablecoin stream; the rest of it is the CRO, which arrived as ether at an address nobody has connected to this.

None of it has moved since 30 August. There is no exchange deposit, no mixer, nothing on the five other major chains we checked. Whoever holds these keys is sitting still.

Three of the wallets on that list appear in no published account of the hack. Between them they hold about $2.95 million across the two chains. They are not hard to link to the rest: one of them dealt out the gas that every other wallet in the operation ran on, five days before the attack.

07The crowd that came for the crumbs

One thing this attack was not is private. Pushing a token up by a factor of 200 in a pool that thin is loud, and the market heard it immediately.

In the 17 minutes around the manipulation, one TONIC trading pool saw 638 trades from 236 different addresses, moving $5.1 million between them. The attacker is three of those trades. Everything else is other people, mostly automated traders with the machine-made wallet addresses that mark them out, piling into a token whose price had come loose from anything real.

That matters for anyone trying to work out what Tectonic can recover. The collateral the attacker left behind is TONIC, and its value depends on those same pools. Those pools were manipulated, and they were also emptied and refilled by hundreds of strangers who had nothing to do with the attack.

08Read the addresses carefully

Within minutes of the drain, a second and unrelated set of actors turned up: address poisoners. They watch for large transfers and copy them using fake tokens, sending the same amounts from lookalike addresses, hoping somebody later copies the wrong one.

Here they mirrored the real transfers to the digit. A counterfeit contract calling itself USD Coin sent exactly 3,563,579.9794 of itself to an address that begins and ends with the same characters as the real destination. Anyone reading a block explorer sees both.

This is why the abbreviated addresses in the early alerts are a problem. One of them, written as 0xc404…72dd, matches the genuine Ethereum wallet and its counterfeit twin equally well. There is a further trap that has nothing to do with the attacker: Cronos carries two separate, legitimate contracts that both report the symbol USDC, and any tool that adds up balances by symbol rather than by contract will merge them.

There is plenty the chain does not record. We cannot see where the $5 million of starting capital was staged, only that it arrived through a bridge and not from any of the wallets in this cluster. We cannot see who any of these people are. And we cannot see what happens next, because Cronos is still stopped, and the moment it starts again the $111 million sitting in those wallets becomes moveable.