Cronos 網路因 7500 萬美元的利用而停止：Tectonic 協議遭受重大打擊

由於價格操縱攻擊，主要藉貸協議 Tectonic 被利用價值 7500 萬美元，Cronos 區塊鏈停止運作。調查正在進行中。

Cronos Network Grinds to a Halt Following Devastating $75 Million Exploit on Tectonic Protocol

Tectonic 協定遭受 7,500 萬美元的破壞性利用後，Cronos 網路陷入癱瘓

In a dramatic turn of events that sent ripples through the decentralized finance world, the Cronos blockchain experienced a significant halt on August 30th. The disruption was triggered by a sophisticated price-manipulation attack on Tectonic, the network's largest decentralized lending protocol, resulting in an estimated loss of up to $75 million. This incident has raised serious questions about security within the Cronos ecosystem and the vulnerability of decentralized lending platforms.

一系列戲劇性的事件在去中心化金融世界中引發了連鎖反應，克羅諾斯區塊鏈在 8 月 30 日經歷了嚴重的停止。這次中斷是由對該網路最大的去中心化借貸協議 Tectonic 的複雜價格操縱攻擊引發的，預計將造成高達 7,500 萬美元的損失。這起事件引發了人們對克羅諾斯生態系統內的安全性以及去中心化借貸平台的脆弱性的嚴重質疑。

How the Exploit Unfolded: A 'Mango-Market Style' Attack

該漏洞是如何展開的：「芒果市場式」攻擊

On-chain researchers have pieced together the sequence of events, revealing a highly coordinated attack. The perpetrator artfully manipulated the price of Tectonic's native governance token, TONIC, inflating its value by approximately 100 times in a mere 20 minutes. This dramatic price surge was exploited to borrow a substantial amount of assets against the artificially inflated collateral, ultimately draining an estimated $66 million to $75 million from the protocol. Researcher Weilin Li likened the maneuver to a 'Mango-market style' pump-and-borrow attack, highlighting the attacker's strategy of leveraging thin liquidity and a high collateral factor (TONIC's was reportedly 20%) to their advantage.

鏈上研究人員將事件序列拼湊在一起，揭示了高度協調的攻擊。犯罪者巧妙地操縱了 Tectonic 原生治理代幣 TONIC 的價格，在短短 20 分鐘內使其價值膨脹了約 100 倍。價格的大幅上漲被人們利用人為膨脹的抵押品借入了大量資產，最終從協議中損失了約 6,600 萬至 7,500 萬美元。研究員 Weilin Li 將這種策略比作「芒果市場式」的拉高借貸攻擊，強調了攻擊者利用稀薄的流動性和高抵押品係數（據報道 TONIC 為 20%）的攻擊者的優勢。

Initial loss estimates hovered around $66 million, but this figure was later revised upwards to approximately $75 million after an additional attacker-controlled address holding around $8 million was identified. Some analyses suggest that as much as $119.5 million was withdrawn from affected pools during the approximately 65-minute window of the attack.

最初的損失估計徘徊在 6,600 萬美元左右，但在發現另一個由攻擊者控制的地址持有約 800 萬美元後，這一數字後來被上調至約 7,500 萬美元。一些分析表明，在大約 65 分鐘的攻擊時間內，受影響的池子被提取了多達 1.195 億美元。

Network Halt: A Necessary Evil to Contain the Damage

網路中斷：遏制損害的必要之舉

The swift decision by Cronos validators to halt the network proved crucial in limiting the attacker's ability to abscond with further funds. Cronos, utilizing a Tendermint Core BFT consensus with a proof-of-authority structure, enabled its capped validator set to coordinate an emergency shutdown. This action successfully restricted the attacker's ability to transfer assets beyond the Cronos network, with only about $6 million reportedly bridged to Ethereum before the halt. The remaining substantial sum is currently frozen on the Cronos Network.

事實證明，克羅諾斯驗證者迅速決定停止網路對於限制攻擊者攜帶更多資金潛逃的能力至關重要。 Cronos 利用具有權威證明結構的 Tendermint Core BFT 共識，使其有限的驗證器集能夠協調緊急關閉。這項行動成功地限制了攻擊者將資產轉移到克羅諾斯網路之外的能力，據報道在停止之前只有約 600 萬美元轉移到以太坊。剩餘的大量資金目前被凍結在克羅諾斯網路上。

Tectonic independently issued warnings for users to avoid interacting with the protocol during its investigation. As of the time of reporting, neither Cronos nor Tectonic has confirmed the definitive cause or the final loss figure, and a timeline for the network's resumption remains unannounced.

Tectonic 獨立向使用者發出警告，避免在調查期間與協定互動。截至發稿時，Cronos 和 Tectonic 均未確認確切原因或最終損失數字，網路復原的時間表仍未公佈。

Broader Implications and the Road Ahead

更廣泛的影響和未來的道路

The Cronos exploit is the latest in a series of similar price-manipulation attacks targeting DeFi protocols with low liquidity. Notably, the Moonwell protocol on the Base network recently lost over $8 million in a comparable incident, and a low-liquidity Pendle market also saw significant liquidations. These events underscore a persistent vulnerability in the DeFi space where thin liquidity can be weaponized.

Cronos 漏洞是一系列針對低流動性 DeFi 協議的類似價格操縱攻擊中的最新一起。值得注意的是，Base 網路上的 Moonwell 協議最近在類似事件中損失了超過 800 萬美元，低流動性的 Pendle 市場也出現了嚴重的清算。這些事件凸顯了 DeFi 領域持續存在的脆弱性，流動性稀薄可以被武器化。

Crypto.com CEO Kris Marszalek confirmed the security breach, assuring the public that the Crypto.com app and exchange were not compromised and that their security team is actively assisting in the investigation. However, as of this publication, no entity has stepped forward to commit to repaying the affected Tectonic depositors, leaving many users in limbo.

Crypto.com 執行長 Kris Marszalek 證實了這個安全漏洞，並向公眾保證 Crypto.com 應用程式和交易所沒有受到損害，並且他們的安全團隊正在積極協助調查。然而，截至本文發佈時，還沒有任何實體出面承諾償還受影響的 Tectonic 儲戶，導致許多用戶陷入困境。

While the situation is undoubtedly serious, the quick network halt did prevent a complete catastrophe. Hopefully, the ongoing investigations will shed light on the vulnerabilities and pave the way for a more secure future for Cronos and Tectonic. In the meantime, let's all keep our fingers crossed for a swift and secure resolution!

雖然情況無疑很嚴重，但網路的快速中斷確實避免了一場徹底的災難。希望正在進行的調查能揭示這些漏洞，並為 Cronos 和 Tectonic 的更安全的未來鋪平道路。同時，讓我們一起祈求快速、安全的解決方案！