Sir_Slowmotion

Someone emptied Tectonic's vault this morning. About $120 million borrowed against collateral genuinely worth a few hundred thousand. It took eleven minutes. Two hours later, Cronos stopped producing blocks. Here's what happened, in plain English. Tectonic is a pawnbroker. You leave something valuable with it some Bitcoin, say and it lends you stablecoins against it. Don't repay, and it keeps your deposit. The cash it lends out is other people's savings, parked there to earn interest. TONIC is Tectonic's own token, and it's nearly worthless per coin. Before today, 3.9 million TONIC was worth about 5p. Tectonic accepts it as collateral anyway. And to work out what your deposit is worth, Tectonic checks the price on VVS at that moment. It trusts the price tag on the market stall. So picture a stall selling pebbles for a penny each. The pawnbroker next door lends money against pebbles, and glances at the stall to value them. A thief walks up and buys nearly every pebble on the stall in one go. With hardly any left, the price tag jumps from a penny to forty pence. He then wheels a barrow of pebbles into the pawnbroker. The pawnbroker looks over at the stall, sees "forty pence each," values the barrow at millions, and hands over everything in the vault. The thief leaves and never comes back for the pebbles. The price drifts back to a penny. The pawnbroker is left holding a pile of gravel and an empty safe. That is exactly what happened. tectonic:native was the pebbles, and the TONIC/USDC pool moved about 40×. How the morning went, UK time: 13:38:56 - The setup. The attacker deploys a contract and, in the same transaction, buys roughly 16 trillion TONIC out of three pools using about $200k of USDC and $400k of CRO. The pool price jumps ~40×. The same contract deposits that TONIC into Tectonic and adds 5 million USDC of real money, so the position looks like an ordinary large customer. 13:41 -13:45 - Two dry runs. Buy more TONIC, deposit it, borrow 2 million and then 1.3 million USDC. Both clear. Nothing stops it. 13:49:39 - The drain. One transaction borrows everything Tectonic has: the USDC, the USDT, the Bitcoin, the Ether, the CRO. It goes to two collection wallets. 13:50–15:15 - The scramble. Copycat bots spot the still-inflated price and scrape the last ~$2 million. Depositors race to withdraw whatever's left. Arbitrageurs drag TONIC back down. CRO and stablecoin prices swing around as roughly $60 million gets pushed through the pools. 15:32:47 — Lights out. Cronos produces its last block. Every public node stops at the same height, which isn't a crash — that's validators halting the chain deliberately. The official RPC had already gone dark before that. So how much was actually stolen? Around $120 million walked out. The attacker put in roughly $5.6 million of his own to make it work - the USDC camouflage plus the CRO and USDC spent moving the price - and that's gone too. Call it about $115 million net, plus the ~$2 million the copycats took. Two things worth taking from this. First: nothing here was "hacked." No key was stolen, no lock was picked. Tectonic did exactly what it was built to do - it read a price off a thin pool and believed it. If your protocol reads spot price directly from a market someone can move, that price is for sale. Anyone with enough capital to shift the pool can tell your contract whatever they like. Spot price is not an oracle, and it hasn't been for years. Second: a chain that can be switched off by its validators is a different animal from one that can't. That's a design choice rather than a flaw, and in a moment like this it's arguably the right call. But it's worth knowing which kind of ground you're standing on before you need to find out. How much was stolen?