Threat Intelligence & APT The Record 1 month ago

Fraudsters steal $6 million from Tectonic crypto platform after inflating token price

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Credit: Tectonic Fraudsters steal $6 million from Tectonic crypto platform after inflating token price At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend. The decentralized lending platform confirmed on Sunday morning that it was dealing with a security incident, and the public blockchain Cronos halted activity..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Tectonic
Credit: Tectonic

Fraudsters steal $6 million from Tectonic crypto platform after inflating token price

At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend. 

The decentralized lending platform confirmed on Sunday morning that it was dealing with a security incident, and the public blockchain Cronos halted activity to prevent an outflow of stolen funds. 

The fraudsters were able to jack up the price of Tectonic’s thinly traded coin to more than 100-times its original price in the span of 20 minutes. They then used the Tonic tokens, with their newly inflated price, as collateral in order to borrow assets against them — attempting to make off with an estimated $74 million, according to blockchain security firms.  

While more than $6 million left the platform, about $68 million was stopped from leaving and is still on the Cronos blockchain. 

Kris Marszalek, CEO of Crypto.com — the company behind Cronos — said they are assisting in the investigation and noted their platform was not affected by the incident. On Monday, Cronos explained that it is back online and told customers that it made the emergency decision to shut the platform down “to protect users from an exploit on the Tectonic protocol.”

“This was deemed necessary as it protected users from being exposed to this exploit,” Cronos CEO Ryan Wyatt said. 

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →