Tectonic says $9.19M remains unrecovered after attack; to drop low-liquidity tokens as collateral

Cronos lending protocol Tectonic published a post-incident report on Sept. 8 (UTC+8) detailing an Aug. 30 exploit. The attacker manipulated the price of TONIC, Tectonic's governance token, then used the inflated valuation as collateral to borrow assets with a combined notional value of $120.4 million across multiple markets in a single transaction. Cronos later paused the network and reverted state. Prior to the pause, the attacker had already bridged out about $9.19 million, which has yet to be recovered. Tectonic said the vulnerability stemmed from TONIC being borrowable and redepositable as collateral within the same transaction. The protocol valued it at spot price with a 20% loan-to-value ratio and lacked safeguards against sharp price spikes as well as limits linked to market depth. The team plans to phase out low-liquidity tokens that are hard to price as eligible collateral and to introduce per-market borrowing caps. More details will be released once the implementation plan is finalized. Tectonic said it is working with forensic firms, law enforcement, stablecoin issuers, exchanges and cross-chain bridges in an effort to recover the stolen funds. (Source: Foresight News)