Cronos 网络因 7500 万美元的利用而停止：Tectonic 协议遭受重大打击

由于价格操纵攻击，主要借贷协议 Tectonic 被利用价值 7500 万美元，Cronos 区块链停止运行。调查正在进行中。

Cronos Network Grinds to a Halt Following Devastating $75 Million Exploit on Tectonic Protocol

Tectonic 协议遭受 7500 万美元的破坏性利用后，Cronos 网络陷入瘫痪

In a dramatic turn of events that sent ripples through the decentralized finance world, the Cronos blockchain experienced a significant halt on August 30th. The disruption was triggered by a sophisticated price-manipulation attack on Tectonic, the network's largest decentralized lending protocol, resulting in an estimated loss of up to $75 million. This incident has raised serious questions about security within the Cronos ecosystem and the vulnerability of decentralized lending platforms.

一系列戏剧性的事件在去中心化金融世界中引发了连锁反应，克罗诺斯区块链在 8 月 30 日经历了严重的停止。此次中断是由对该网络最大的去中心化借贷协议 Tectonic 的复杂价格操纵攻击引发的，预计造成高达 7500 万美元的损失。这一事件引发了人们对克罗诺斯生态系统内的安全性以及去中心化借贷平台的脆弱性的严重质疑。

How the Exploit Unfolded: A 'Mango-Market Style' Attack

该漏洞是如何展开的：“芒果市场式”攻击

On-chain researchers have pieced together the sequence of events, revealing a highly coordinated attack. The perpetrator artfully manipulated the price of Tectonic's native governance token, TONIC, inflating its value by approximately 100 times in a mere 20 minutes. This dramatic price surge was exploited to borrow a substantial amount of assets against the artificially inflated collateral, ultimately draining an estimated $66 million to $75 million from the protocol. Researcher Weilin Li likened the maneuver to a 'Mango-market style' pump-and-borrow attack, highlighting the attacker's strategy of leveraging thin liquidity and a high collateral factor (TONIC's was reportedly 20%) to their advantage.

链上研究人员将事件序列拼凑在一起，揭示了一场高度协调的攻击。犯罪者巧妙地操纵了 Tectonic 原生治理代币 TONIC 的价格，在短短 20 分钟内使其价值膨胀了约 100 倍。价格的大幅上涨被人利用人为膨胀的抵押品借入了大量资产，最终从协议中损失了约 6600 万至 7500 万美元。研究员 Weilin Li 将这种策略比作“芒果市场式”的拉高借贷攻击，强调了攻击者利用稀薄的流动性和高抵押品系数（据报道 TONIC 为 20%）的攻击者的优势。

Initial loss estimates hovered around $66 million, but this figure was later revised upwards to approximately $75 million after an additional attacker-controlled address holding around $8 million was identified. Some analyses suggest that as much as $119.5 million was withdrawn from affected pools during the approximately 65-minute window of the attack.

最初的损失估计徘徊在 6600 万美元左右，但在发现另一个由攻击者控制的地址持有约 800 万美元后，这一数字后来被上调至约 7500 万美元。一些分析表明，在大约 65 分钟的攻击时间内，受影响的池子被提取了多达 1.195 亿美元。

Network Halt: A Necessary Evil to Contain the Damage

网络中断：遏制损害的必要之举

The swift decision by Cronos validators to halt the network proved crucial in limiting the attacker's ability to abscond with further funds. Cronos, utilizing a Tendermint Core BFT consensus with a proof-of-authority structure, enabled its capped validator set to coordinate an emergency shutdown. This action successfully restricted the attacker's ability to transfer assets beyond the Cronos network, with only about $6 million reportedly bridged to Ethereum before the halt. The remaining substantial sum is currently frozen on the Cronos Network.

事实证明，克罗诺斯验证者迅速决定停止网络对于限制攻击者携带更多资金潜逃的能力至关重要。 Cronos 利用具有权威证明结构的 Tendermint Core BFT 共识，使其有限的验证器集能够协调紧急关闭。这一行动成功地限制了攻击者将资产转移到克罗诺斯网络之外的能力，据报道在停止之前只有约 600 万美元转移到以太坊。剩余的大量资金目前被冻结在克罗诺斯网络上。

Tectonic independently issued warnings for users to avoid interacting with the protocol during its investigation. As of the time of reporting, neither Cronos nor Tectonic has confirmed the definitive cause or the final loss figure, and a timeline for the network's resumption remains unannounced.

Tectonic 独立向用户发出警告，避免在调查期间与协议进行交互。截至发稿时，Cronos 和 Tectonic 均未确认确切原因或最终损失数字，网络恢复的时间表仍未公布。

Broader Implications and the Road Ahead

更广泛的影响和未来的道路

The Cronos exploit is the latest in a series of similar price-manipulation attacks targeting DeFi protocols with low liquidity. Notably, the Moonwell protocol on the Base network recently lost over $8 million in a comparable incident, and a low-liquidity Pendle market also saw significant liquidations. These events underscore a persistent vulnerability in the DeFi space where thin liquidity can be weaponized.

Cronos 漏洞是一系列针对低流动性 DeFi 协议的类似价格操纵攻击中的最新一起。值得注意的是，Base 网络上的 Moonwell 协议最近在一次类似事件中损失了超过 800 万美元，低流动性的 Pendle 市场也出现了严重的清算。这些事件凸显了 DeFi 领域持续存在的脆弱性，流动性稀薄可以被武器化。

Crypto.com CEO Kris Marszalek confirmed the security breach, assuring the public that the Crypto.com app and exchange were not compromised and that their security team is actively assisting in the investigation. However, as of this publication, no entity has stepped forward to commit to repaying the affected Tectonic depositors, leaving many users in limbo.

Crypto.com 首席执行官 Kris Marszalek 证实了这一安全漏洞，并向公众保证 Crypto.com 应用程序和交易所没有受到损害，并且他们的安全团队正在积极协助调查。然而，截至本文发布时，还没有任何实体出面承诺偿还受影响的 Tectonic 储户，导致许多用户陷入困境。

While the situation is undoubtedly serious, the quick network halt did prevent a complete catastrophe. Hopefully, the ongoing investigations will shed light on the vulnerabilities and pave the way for a more secure future for Cronos and Tectonic. In the meantime, let's all keep our fingers crossed for a swift and secure resolution!

虽然情况无疑很严重，但网络的快速中断确实避免了一场彻底的灾难。希望正在进行的调查能够揭示这些漏洞，并为 Cronos 和 Tectonic 的更安全的未来铺平道路。与此同时，让我们一起祈求快速、安全的解决方案！