Crypto.com-Linked Tectonic Hit by Price Manipulation Attack, With More Than $74 Million Borrowed Out

Tectonic, a decentralized lending platform linked to Crypto.com, was hit by a price-manipulation attack that allowed more than $74 million of crypto assets to be borrowed from the protocol. At least $6 million was ultimately moved to the Ethereum network.

Bloomberg reported on Aug. 31, citing blockchain security firm PeckShield, that the attacker drove up the price of Tectonic’s native TONIC token by about 300-fold in roughly 20 minutes. The attacker then used the token as collateral to borrow large amounts of other cryptocurrencies.

PeckShield said the total value of the loans exceeded $74 million. But only about $6 million was transferred to Ethereum before the Cronos network was halted. Cronos validators stopped network transactions after confirming the attack, preventing additional cross-chain transfers.

According to DefiLlama, crypto assets deposited on Tectonic plunged to about $3 million from roughly $122 million before the attack.

Security firms see the incident as less a conventional hack targeting a flaw in the code than an attack exploiting weaknesses in collateral pricing and risk controls. “Tectonic’s risk-management settings were poor,” Failsafe Chief Executive Officer Aneirin Flynn said. The attacker artificially inflated the price of a low-value token and then used that value to borrow other assets.

Crypto.com Chief Executive Officer Kris Marszalek said the incident did not affect Crypto.com’s centralized exchange and that all customer assets remain safe.

Crypto.com and Cronos Labs are now pursuing a plan to roll the blockchain back to its pre-attack state. They have not disclosed when the network will return to normal operations.