Tectonic: oracle prices, receipt tokens and the outflow calculation

#Tectonic allowed an externally manipulated oracle price and an internally inflated receipt-token exchange rate to reinforce each other across attacker-controlled accounts.

The protocol continued recognising collateral whose reported value had become detached from both the attacker’s actual capital and the liquidity available to realise that value.

The widely repeated estimate of approximately $74 million to $75 million is materially incomplete if presented as the total amount removed from Tectonic.

That figure primarily counts assets attributed to a subset of attacker-controlled externally owned accounts: approximately $60 million at the main #Cronos collection address, approximately $8 million at an additional Cronos address and approximately $6.29 million bridged to Ethereum.

A separate archive-node reconstruction found that approximately $75.7 million went to an external wallet while another $43.7 million went to a contract address, producing a combined market outflow of approximately $119.5 million.

The operation began with 5 million USDC supplied to Tectonic as collateral. While Tectonic’s TONIC oracle still valued the token at only $0.000000010622, one attacker-controlled account borrowed approximately 376.54 trillion TONIC and transferred it to a second account.

The second account supplied approximately 41.87 trillion TONIC normally, receiving tTONIC in return.

Most of the remaining borrowed TONIC was transferred directly into the tTONIC market contract without repaying the original TONIC debt.

That distinction remains central to the attack.

Central.

Tectonic’s exchange-rate accounting included both available market cash and outstanding borrows.

The debt remained assigned to the first account, while the direct tectonic:native transfers replenished the market’s cash balance without cancelling that debt.

This increased the tTONIC exchange rate and therefore increased the reported collateral value of the tTONIC held by the second account.

The attack therefore cannot be accurately reduced to someone buying approximately 16 trillion TONIC, pumping its spot price and depositing the purchased tokens as collateral.

The transactions show 2 mutually reinforcing manipulation paths: an external increase in the TONIC price accepted by Tectonic’s oracle and an internal increase in the tTONIC exchange rate used to value collateral.

Using the inflated tTONIC position, the second account borrowed 200,000 USDC and approximately 6.96 million CRO. Those funds were used to purchase approximately 16.23 trillion additional TONIC from the TONIC/USDC, TONIC/WCRO and TONIC/VVS pools. The acquired TONIC was then transferred into the tTONIC market, further increasing its exchange rate. The abnormal price movement remains visible across the affected VVS pools.

Tectonic was not reading the manipulated VVS pool spot prices directly inside each borrowing transaction. Its custom TONIC/USD feed was updated offchain.

However, the feed accepted a series of rapidly increasing prices after the attacker had moved the underlying pools:

12:19:37 UTC: $0.000000010622
12:39:10 UTC: $0.000000068593
12:44:08 UTC: $0.000000918893
12:49:13 UTC: $0.000002076321

Additional transactions at 12:41 and 12:45 borrowed approximately 3.31 million USDC and 21.21 million CRO.

Those assets were used to buy another 7.68 trillion TONIC, which was again transferred into the market. These transactions were not harmless test loans or dry runs.

They reinforced both the manipulated external TONIC price and the internally inflated tTONIC exchange rate immediately before the final extraction.

At 12:49:39 UTC, the final transaction extracted approximately:

55.24 million USDC

45.65 million USDT
98.04 WBTC
1,895.10 WETH
32.93 CDCBTC
379.67 CDCETH
16.75 million CRO
26.24 million LCRO
270,650 XRP

The updated destination map contains at least 3 relevant Cronos destinations:

Main collection EOA
0x7d4e7e5dcb0ccc66b4f0f8b0f30da5078ad4f2dc

Attacker-deployed collection contract
0x085f3115ca368aa262246d22f9476e1e2c87e8be

Additional attacker-controlled Cronos address
0x215adfc84332d8dfdd5afc77af69cceec0bcd3fc

It identifies it as a contract deployed by the attacker approximately 12 days before the incident, and the archive-node accounting attributes approximately $43.7 million of the removed assets to that contract. A further address, 0x215a…d3fc, was subsequently linked to the operation with approximately $8 million in USDC.

Approximately $6.29 million was bridged from Cronos to Ethereum before block production stopped.

Those assets were reportedly converted into approximately 2,592 ETH.

The remaining majority of the traced assets is still located on Cronos and cannot currently move while the chain remains halted.

The attacker’s identifiable external capital still appears to have been approximately 5 million USDC plus gas. Some public reports describe the attacker as having spent approximately $5.6 million of personal capital, but that formulation appears to count the first 200,000 USDC and approximately 6.96 million CRO used to move the pools.

Those assets were borrowed from Tectonic, not introduced from an external attacker wallet.

Aggregate borrowing attributable to the primary operation appears to have been close to $125 million, because several million dollars were borrowed and recycled into the TONIC manipulation rather than retained as final proceeds.

Separate copycat bots reportedly extracted another approximately $2 million while the manipulated price remained active. That activity should be separated from the primary attacker’s proceeds rather than silently added to the same profit estimate.

At incident-time prices, the primary operation therefore appears to have generated approximately $114 million to $115 million in gross economic gain against approximately $5 million in identifiable external capital. It is no longer precise to describe the entire amount as realised profit.

Only approximately $6.29 million is currently known to have escaped Cronos and been converted on Ethereum.

The remaining assets are frozen on Cronos, and their eventual recoverability depends on whether validators restart the chain unchanged, block specific addresses, alter token contracts, execute a state intervention or arrange another recovery mechanism.

Approximately $119.5 million is the current broader estimate for gross market outflow or depletion of Tectonic’s affected lending markets.

An archive-node analysis separately identified approximately $32.6 million in residual bad debt, after recording 752 liquidations that seized approximately $8.71 million from other users.

Those figures measure different parts of the protocol’s accounting and cannot be used interchangeably. Tectonic has not yet published the market-by-market reconciliation required to determine the final recognised loss or bad debt.
T
As of 31 August 2026 at 13:39 UTC, Cronos remains halted.

The official explorer still identifies block 90,907,150 as the latest block, corresponding to 30 August 2026 at 14:32:47 UTC.

Cronos has issued a second statement confirming that the network remains halted while security teams investigate. No restart timetable, rollback decision, address-freezing plan, recovery arrangement or depositor compensation framework has been announced.

Tectonic’s recorded TVL fell from approximately $121.7 million before the incident to roughly $3 million after the drain.

This is consistent with the broader market-outflow estimate, but TVL should not itself be treated as a final loss calculation because it is also affected by token prices, outstanding borrows, liquidations and the frozen state of the network.

The central failure remains broader than the manipulation of a thin spot market. Tectonic allowed an externally manipulated oracle price and an internally inflated receipt-token exchange rate to reinforce each other across attacker-controlled accounts.

The protocol continued recognising collateral whose reported value had become detached from both the attacker’s actual capital and the liquidity available to realise that value.

Post-mortems honestly bore me a little.

What matters far more is education, practical security knowledge, and showing both teams and users how to recognise these risks before the damage is done.

But as my latest bug bounty experience showed, almost nobody seems interested in treating documented vulnerabilities with the seriousness they deserve.

What many teams forget is that a formal warning creates a record.

Once they have been informed about a material security risk and knowingly choose not to investigate, mitigate or warn users, that inaction can carry serious legal consequences, including potential civil or criminal liability depending on the facts and jurisdiction.