TectonicFi、Cronos 漏洞利用：瞬间损失 7400 万美元，但快速停止可以挽救大部分时间

由于价格操纵攻击，TectonicFi 在 Cronos 上损失了约 7400 万美元。虽然 600 万美元已桥接至以太坊，但 Cronos 链的快速停止导致 6000 万美元陷入困境，凸显了 DeFi 安全方面的重要教训。

Well, folks, it seems the Wild West of decentralized finance just got a little wilder. TectonicFi, a major player on the Cronos blockchain, recently found itself in the crosshairs of a cunning attacker, resulting in an estimated $74 million exploit. But here’s the kicker: thanks to a quick-thinking network halt, the damage was largely contained, leaving a significant chunk of the stolen loot stranded.

好吧，伙计们，去中心化金融的狂野西部似乎变得更加狂野了。 TectonicFi 是 Cronos 区块链上的主要参与者，最近发现自己成为狡猾攻击者的目标，造成了估计价值 7400 万美元的攻击。但问题在于：由于网络迅速中断，损失基本上得到了控制，大量被盗的战利品被搁浅。

The Heist: A Mango-Market Style Maneuver

抢劫：芒果市场式的策略

According to on-chain researchers, this wasn't your run-of-the-mill hack. The attacker pulled off what's being dubbed a 'Mango-market style' pump-and-borrow attack. They manipulated the price of Tectonic's TONIC governance token, inflating it by a whopping 100x in a mere 20 minutes. With this artificially boosted collateral, they then borrowed other assets, draining between $66 million and $75 million from the protocol. It's a classic move: pump a thinly liquid asset, borrow against its inflated value, and poof, you're rich. Or so they thought.

根据链上研究人员的说法，这不是普通的黑客攻击。攻击者实施了所谓的“芒果市场式”拉高借钱攻击。他们操纵了 Tectonic 的 TONIC 治理代币的价格，在短短 20 分钟内将其价格飙升了 100 倍。通过这种人为增加的抵押品，他们随后借入了其他资产，从协议中流失了 6600 万至 7500 万美元。这是一个经典的举动：注入流动性稀薄的资产，以其膨胀的价值为抵押进行借贷，然后噗，你就富有了。或者说他们是这么认为的。

Cronos to the Rescue: A Rapid Response Limits the Bleed

克洛诺斯救援：快速反应限制流血

Here’s where the story takes a turn. While the attacker did manage to bridge about $6 million of the stolen assets to the Ethereum network, their grand escape was abruptly cut short. The Cronos blockchain, utilizing a Tendermint Core BFT consensus and a proof-of-authority structure, was brought to an emergency halt. This swift action by validators prevented the attacker from transferring the majority of the funds off the network, leaving approximately $60 million stuck on Cronos, according to blockchain security firm PeckShield.

故事就在这里发生了转折。虽然攻击者确实设法将约 600 万美元的被盗资产转移到以太坊网络，但他们的大逃亡却突然中断了。使用 Tendermint Core BFT 共识和权威证明结构的 Cronos 区块链被紧急停止。据区块链安全公司 PeckShield 称，验证者的迅速行动阻止了攻击者将大部分资金转移出网络，导致大约 6000 万美元滞留在 Cronos 上。

This incident really underscores the critical importance of rapid incident response in the DeFi space. Imagine a bank heist where the getaway car breaks down right outside, with most of the cash still inside. That's essentially what happened here. The quick halt by Cronos validators significantly limited the financial impact of what could have been a far more devastating loss for TectonicFi and its depositors.

这一事件确实凸显了快速事件响应在 DeFi 领域的至关重要性。想象一下银行抢劫案，逃跑的汽车在外面抛锚，而大部分现金仍在里面。这基本上就是这里发生的事情。 Cronos 验证者的快速停止极大地限制了对 TectonicFi 及其储户来说可能造成更具毁灭性损失的财务影响。

The Lingering Questions and the Look Ahead

挥之不去的问题和未来的展望

While the immediate crisis was largely mitigated, several questions remain. Can the trapped assets be recovered? What additional security measures will TectonicFi and Cronos implement to prevent future attacks of this nature? Investigations are ongoing, and both Tectonic and Cronos have cautioned users about interacting with the protocol while they get to the bottom of things. Crypto.com CEO Kris Marszalek has confirmed that their app and exchange were not compromised and that their security team is assisting in the investigation. However, as of now, no entity has committed to repaying Tectonic depositors.

虽然眼前的危机已基本缓解，但仍存在一些问题。被困资产能否追回？ TectonicFi 和 Cronos 将实施哪些额外的安全措施来防止未来出现此类性质的攻击？调查正在进行中，Tectonic 和 Cronos 都警告用户在查明真相时不要与协议进行交互。 Crypto.com 首席执行官 Kris Marszalek 确认他们的应用程序和交易所没有受到损害，并且他们的安全团队正在协助调查。然而，截至目前，还没有任何实体承诺偿还 Tectonic 储户。

This TectonicFi exploit serves as a stark reminder that even in the cutting-edge world of decentralized finance, security is paramount. It’s a constant cat-and-mouse game between innovators and exploiters. But for today, we can appreciate the quick thinking that saved a substantial chunk of change. It just goes to show, sometimes even in the face of a digital heist, a well-timed pause can make all the difference. Now, if you'll excuse me, I'm off to secure my own digital piggy bank. You never know when the next 'pump-and-borrow' artist might come knocking!

这一 TectonicFi 漏洞清楚地提醒我们，即使在去中心化金融的尖端世界中，安全性也是至关重要的。这是创新者和开拓者之间持续不断的猫鼠游戏。但今天，我们可以欣赏到节省了大量变革的敏捷思维。它只是表明，有时即使面对数字抢劫，适时的暂停也能带来截然不同的结果。现在，请原谅，我要去保护我自己的数字存钱罐。你永远不知道下一个“拉高借钱”的艺术家什么时候会来敲门！