Pump a Token by Hundreds of Times, Drain the Liquidity: Inside the Tectonic AttackOn August 30, an attacker targeted Tectonic, a lending protocol on Cronos. The key was manipulating the price of the illiquid TONIC token, pushing it up by hundreds of times and using the inflated value to borrow liquid assets.
The attack unfolded in several steps:➤ 5M USDC was deposited into the position;
➤ borrowed USDC and CRO were used to buy TONIC across three VVS pools;
➤ TONIC’s price increased by roughly 454× against USDC, 599× against WCRO, and 668× against VVS;
➤ TONIC was repeatedly borrowed and supplied back into Tectonic, allowing liquid assets to be withdrawn from the protocol.
Some of the funds left Cronos before the network stoppedAfter the attack, the assets were distributed across several addresses. BitOK analysts traced 6.34M USDC from Cronos to Ethereum, where the entire amount was swapped for ETH. At the time of our check, the main Ethereum address still held 2,592 ETH.
Expanding the cluster revealed earlier links. One address in the funding chain had received funds from Tornado Cash. Another connected branch moved 4,532 USDC through Arbitrum to Hyperliquid, where it was used to buy XMR1. No withdrawal of native XMR to the Monero network was confirmed.
Less than two hours after the position was created, Cronos stopped producing new blocks. Assets still on Cronos therefore can’t move while the network remains halted. That doesn’t mean the funds were seized or permanently frozen.
