TectonicFi、Cronos 漏洞利用：瞬間損失 7,400 萬美元，但快速停止可以挽救大部分時間

由於價格操縱攻擊，TectonicFi 在 Cronos 上損失了約 7,400 萬美元。雖然 600 萬美元已橋接至以太坊，但 Cronos 鏈的快速停止導致 6000 萬美元陷入困境，凸顯了 DeFi 安全的重要教訓。

Well, folks, it seems the Wild West of decentralized finance just got a little wilder. TectonicFi, a major player on the Cronos blockchain, recently found itself in the crosshairs of a cunning attacker, resulting in an estimated $74 million exploit. But here’s the kicker: thanks to a quick-thinking network halt, the damage was largely contained, leaving a significant chunk of the stolen loot stranded.

好吧，夥計們，去中心化金融的狂野西部似乎變得更加狂野了。 TectonicFi 是 Cronos 區塊鏈上的主要參與者，最近發現自己成為狡猾攻擊者的目標，造成了估計價值 7400 萬美元的攻擊。但問題在於：由於網路迅速中斷，損失基本上得到了控制，大量被盜的戰利品被擱淺。

The Heist: A Mango-Market Style Maneuver

搶劫：芒果市場式的策略

According to on-chain researchers, this wasn't your run-of-the-mill hack. The attacker pulled off what's being dubbed a 'Mango-market style' pump-and-borrow attack. They manipulated the price of Tectonic's TONIC governance token, inflating it by a whopping 100x in a mere 20 minutes. With this artificially boosted collateral, they then borrowed other assets, draining between $66 million and $75 million from the protocol. It's a classic move: pump a thinly liquid asset, borrow against its inflated value, and poof, you're rich. Or so they thought.

根據鏈上研究人員的說法，這不是普通的駭客攻擊。攻擊者實施了所謂的「芒果市場式」拉高借錢攻擊。他們操縱了 Tectonic 的 TONIC 治理代幣的價格，在短短 20 分鐘內將其價格飆升了 100 倍。透過這種人為增加的抵押品，他們隨後借入了其他資產，從協議中流失了 6,600 萬至 7,500 萬美元。這是一個經典的舉動：注入流動性稀薄的資產，以其膨脹的價值為抵押進行借貸，然後噗，你就富有了。或者說他們是這麼認為的。

Cronos to the Rescue: A Rapid Response Limits the Bleed

克洛諾斯救援：快速反應限制出血

Here’s where the story takes a turn. While the attacker did manage to bridge about $6 million of the stolen assets to the Ethereum network, their grand escape was abruptly cut short. The Cronos blockchain, utilizing a Tendermint Core BFT consensus and a proof-of-authority structure, was brought to an emergency halt. This swift action by validators prevented the attacker from transferring the majority of the funds off the network, leaving approximately $60 million stuck on Cronos, according to blockchain security firm PeckShield.

故事就在這裡發生了轉折。雖然攻擊者確實設法將約 600 萬美元的被盜資產轉移到以太坊網絡，但他們的大逃亡卻突然中斷了。使用 Tendermint Core BFT 共識和權威證明結構的 Cronos 區塊鏈被緊急停止。據區塊鏈安全公司 PeckShield 稱，驗證者的迅速行動阻止了攻擊者將大部分資金轉移出網絡，導致約 6,000 萬美元滯留在 Cronos 上。

This incident really underscores the critical importance of rapid incident response in the DeFi space. Imagine a bank heist where the getaway car breaks down right outside, with most of the cash still inside. That's essentially what happened here. The quick halt by Cronos validators significantly limited the financial impact of what could have been a far more devastating loss for TectonicFi and its depositors.

這事件確實凸顯了快速事件回應在 DeFi 領域的至關重要性。想像銀行搶劫案，逃跑的汽車在外面拋錨，而大部分現金仍在裡面。這基本上就是這裡發生的事情。 Cronos 驗證者的快速停止極大地限制了對 TectonicFi 及其儲戶來說可能造成更具毀滅性損失的財務影響。

The Lingering Questions and the Look Ahead

揮之不去的問題與未來的展望

While the immediate crisis was largely mitigated, several questions remain. Can the trapped assets be recovered? What additional security measures will TectonicFi and Cronos implement to prevent future attacks of this nature? Investigations are ongoing, and both Tectonic and Cronos have cautioned users about interacting with the protocol while they get to the bottom of things. Crypto.com CEO Kris Marszalek has confirmed that their app and exchange were not compromised and that their security team is assisting in the investigation. However, as of now, no entity has committed to repaying Tectonic depositors.

雖然眼前的危機已基本緩解，但仍存在一些問題。受困資產能否追回？ TectonicFi 和 Cronos 將實施哪些額外的安全措施來防止未來出現此類性質的攻擊？調查正在進行中，Tectonic 和 Cronos 都警告用戶在找出真相時不要與協議互動。 Crypto.com 執行長 Kris Marszalek 確認他們的應用程式和交易所沒有受到損害，並且他們的安全團隊正在協助調查。然而，截至目前，還沒有任何實體承諾償還 Tectonic 儲戶。

This TectonicFi exploit serves as a stark reminder that even in the cutting-edge world of decentralized finance, security is paramount. It’s a constant cat-and-mouse game between innovators and exploiters. But for today, we can appreciate the quick thinking that saved a substantial chunk of change. It just goes to show, sometimes even in the face of a digital heist, a well-timed pause can make all the difference. Now, if you'll excuse me, I'm off to secure my own digital piggy bank. You never know when the next 'pump-and-borrow' artist might come knocking!

這個 TectonicFi 漏洞清楚地提醒我們，即使在去中心化金融的尖端世界中，安全性也是至關重要的。這是創新者和拓荒者之間持續不斷的貓鼠遊戲。但今天，我們可以欣賞到節省了大量變革的敏捷思維。它只是表明，有時即使面對數位搶劫，適時的暫停也能帶來截然不同的結果。現在，請原諒，我要去保護我自己的數位存錢筒。你永遠不知道下一個「拉高借錢」的藝術家甚麼時候會來敲門！