I went off social media for 5 months. I returned to zero arrests from the Epstein Files and the most disgusting evidence of evil one could possibly do. @elonmusk thank you for this platform of transparency. @FBIDirectorKash@AGPamBondi you arenβt immune from tribunal.
@BlockWatchdog I still think it was multiple people and inside job. If they truly reversed block, I would have received the exact amount I had in lending. They stole 18Billion tonic from me
CertiK and PeckShield put the Tectonic hack at $74-75M. That's only the stablecoins sent to one address.
Tectonic's own market balances fell $119.1M. $42.4M of it sits in a contract nobody has named:
0x085f3115ca368aa262246d22f9476e1e2c87e8be
I reconstructed the whole thing from Cronos archive state, because the public explorer is down and the chain is still halted.
ββ THE ADDRESSES NOBODY NAMED ββ
Attacker EOA: 0x4266a0e6a0f0ef90abcff3bb089932ca0cce3652
Orchestrator contract: 0xd3aac8a1a9e412e2c590463a8b6f90125e23f1f3 (deployed Aug 30, 12:38:56 UTC)
Borrower contract: 0x2dc6a36f4e5eeefe112c01569de96dea496bb618 (created in the same tx)
Vault contract: 0x085f3115ca368aa262246d22f9476e1e2c87e8be
β deployed by the same EOA on Aug 18, 14:47:15 UTC. Twelve days before the exploit.
It currently holds 13,978,766 USDC, 9,812,697 USDT, 92.04 WBTC, 1,765.10 WETH, 32.93 CDCBTC, 349.67 CDCETH, 23,093,728 LCRO, 24,287,549 WCRO and 120,650 XRP. About $42.4M.
Starting capital: 5,000,950 USDC, bridged onto Cronos in $100-500K tranches between Aug 28 and Aug 30 through 0xcdfba496180865a71266608ade6b21ab1f788888.
ββ WHY $74M IS THE WRONG NUMBER ββ
The drain transaction is
0xddc9dc47d330116332ae687ba939f6d6196c4cc5950b2cdb04ae826520eeca20
One call. Selector 0x26faf313 β borrowMax(). It borrowed the entire cash of every market, matching each market's cashPrior to the unit:
USDT 34,238,092.49 β 0x7d4e $34,235,145
USDT 11,412,697.50 β 0x085f $11,411,715
USDC 41,429,611.35 β 0x7d4e $41,427,963
USDC 13,809,870.45 β 0x085f $13,809,321
WBTC 98.04 β 0x085f $7,713,270
WETH 1,895.10 β 0x085f $4,669,805
CDCBTC 32.93 β 0x085f $2,590,723
LCRO 26,243,727.70 β 0x085f $2,104,797
CDCETH 379.67 β 0x085f $1,005,170
WCRO 16,745,476.51 β 0x085f $1,028,641
XRP 270,650.42 β 0x085f $378,736
βββββββββββ
$120,375,285
Stablecoins were split exactly 75/25 between 0x7d4e and the unnamed contract. Everything else went to the unnamed contract at 100%.
41,429,611 + 34,238,092 = $75.66M. That is the "$75M at three addresses." Both firms counted the 75% slice of two assets and stopped.
Tectonic's market cash, before the attack vs. at the halt, priced with the protocol's own oracle from before the manipulation:
tUSDC 54,325,388.59 β 0.03 -$54,320,567
tUSDT 45,550,247.50 β 966,882.66 -$44,579,503
tWBTC 98.18 β 4.45 -$7,361,887
tWETH 1,885.07 β 34.28 -$4,564,140
tCDCBTC 33.30 β 0.13 -$2,605,552
tCRO 46,053,295.86 β 1,977,118.96 -$2,536,848
tLCRO 26,880,464.61 β 3,147,757.71 -$1,783,431
tCDCETH 380.79 β 0.65 -$1,007,191
tXRP 270,650.42 β 8,213.53 -$366,692
ββββββββββββ
-$119,125,811
tUSDC has three cents left in it.
ββ IT WAS NOT AN ORACLE TRICK IN ONE BLOCK ββ
Setup tx: 0x0fce5ae8d2eeb82c838e750d0e25af1564a2c7d05bf843dd1cfea102ce587d06 β 33.2M gas, 677 logs.
1. Deposit 5M USDC as tUSDC. CF 0.8 β ~$4M of borrowing power.
2. Borrow the entire tTONIC market: 3,844,366,314,940.79 TONIC, worth ~$4.08M at the real price of $1.0622e-8. Right at the limit. Nothing broken yet.
3. Re-deposit that TONIC through the second contract.
4. Repeat. And after 12 loops the mint stops being necessary β the borrower simply sends TONIC to the tTONIC contract as a plain ERC-20 transfer. Cash refilled, no accounting event, borrow again.
98 iterations.
End state of one transaction:
β parent debt: 376.5 trillion TONIC
β child collateral: 309.2T tTONIC = 335.7 trillion TONIC
TONIC's total supply is 500 trillion. The attacker's collateral claim was 67% of every TONIC in existence, and 14.7x all the TONIC sitting in every DEX pool combined.
Those pools held about $0.5M across both sides.
tTONIC's totalSupply went from 60.06T to 369.26T in that single transaction. One address created six times more deposits than existed before it.
ββ THE SECOND INFLATION NOBODY MENTIONED ββ
In Compound v2, exchangeRate = (cash + totalBorrows - reserves) / totalSupply.
Outstanding borrows count as assets of the market. So the attacker's own unbacked 376.5T TONIC debt landed in the numerator of the token he was posting as collateral.
tTONIC's exchange rate went 1.354e9 β 1.0857e10 in that one transaction. An 8x jump. Roughly 95% of the tTONIC market's balance sheet was the attacker's own debt.
ββ THEN THEY JUST WAITED FOR THE FEED ββ
Three follow-up transactions (12:40:39, 12:41:29, 12:45:25, selector 0x7b9f30b8) each borrowed USDC and CRO against the inflated collateral, bought TONIC on VVS with it, and donated the TONIC back to the tToken contract. Total fed into the pools: 3,509,440 USDC + 28,163,915 CRO β $5.24M β all borrowed from Tectonic itself. The first attempt at 12:40:39 reverted; they adjusted parameters and retried.
TONIC's price in Tectonic's oracle (0xd360d8cabc1b2e56ecf348bff00d2bd9f658754a), block by block:
$1.0622e-8 baseline
$6.8593e-8 after the setup tx
$9.1889e-7 around block 90,896,600
$2.0763e-6 around block 90,897,080
ββββββββββββββββββββββββββββββββ
x195.5 in about four minutes
The price is flat between updates and then jumps. This is a pushed feed that follows the manipulated DEX price with a lag. The attacker never had to beat an oracle inside a block β he bought TONIC and waited for the feed to catch up.
Collateral value of the borrower contract as it moved:
12:38:56 $3,565,813
12:40:39 $23,026,727
12:45:25 $314,381,596
12:49:39 $710,376,013
At a 0.2 collateral factor, $710M of collateral is $142M of borrowing power. They took $120M and left.
ββ WHERE THE MONEY IS ββ
At block 90,907,150, the moment Cronos stopped:
0x7d4e...f2dc β $60,115,712
0x085f3115... β ~$42,410,000
0x215adfc8... β $7,770,094 USDC
Ethereum 0xc404160b... β 2,592.215 ETH β $6,390,000
βββββββββββββ
β $116.7M
One correction to every tracker showing 0x7d4e: a token scan shows it empty. The $60.1M is a 75.008% LP position in the VVS USDT/USDC pool 0x39cc0e14795a8e6e9d02a21091b81fe0d61d82f9. Thirty million USDC and thirty million USDT went in, LP tokens came back.
ββ THE HALT DIDN'T CATCH THE ETHEREUM LEG ββ
Between 13:03:23 and 14:15:47 UTC, 6,336,359.647494 USDC moved to 0xc404160b79bd8905061a1caecbeca2eeab3f72dd on Ethereum in 34 tranches, relayed by 0xf70da97812cb96acdf810712aa562db8dfa3dbef β an intent-bridge solver that also appears on the Cronos side, not the canonical bridge.
Every cent was swapped into ETH through the Uniswap v3 USDC/WETH 0.05% pool. 2,563.22 ETH received, average $2,472.02.
Cronos halted at 14:32:47 UTC β 1 hour 43 minutes after the drain. That address was still swapping at 01:43 UTC the next day. Balance now 2,592.215 ETH.
ββ A WARNING ON THE ADDRESSES IN THOSE ALERTS ββ
Minutes after the drain, address-poisoning bots mirrored the transfers with counterfeit USDC and USDT (0xa9f071191cc59b4a0a970dca02a16ddfe803719b, 0xc6203d86f5efbed7f9512755f3e6132ee50d03d1) sent to lookalikes:
0x7d4eb7d6fd2bd97ffa042fe8814accf12674f2dc
0x215ab1ddc9d7b079202371ef5332d37dcfdcd3fc
0xc404df04ce19dbbdd0350e2ea4e7b3eff4ff72dd
PeckShield's abbreviation "0xc404...72dd" matches both the real address and the poisoned twin. The real one is 0xc404160b79bd8905061a1caecbeca2eeab3f72dd.
CertiK's alert lists three links, but 0x7d4e...f2dc appears twice β the third address was never actually named.
ββ STATUS ββ
Cronos has produced no blocks since 14:32:47 UTC on Aug 30. Two independent RPCs agree on the same head, block 90,907,150. That is more than eleven hours.
https://t.co/haaCWFEjbG is also down β its backend returns an internal server error on every address, so Tectonic's verified sources are unreadable right now. Everything above was rebuilt from events and archive eth_call, not from source.
Against the ~$119.1M hole, the protocol holds the attacker's 5M USDC and 335.7T TONIC of collateral, now worth about $9.8M after the price fell back to $3.0067e-8. Net bad debt is on the order of $105-110M.
All USD figures use Tectonic's own oracle at the block before the attack, to keep the manipulated spot out of the arithmetic.
This Bible series is something Iβve felt called to do for a long time, and in a lot of ways, I feel like everything Iβve done up to this point has prepared me for it. Iβm not a theologian or a scholar, Iβm just someone trying to understand the Bible for myself, ask the questions Iβve always had, and hopefully bring some of you along with me on that journey. This one is deeply personal to me, and Iβm excited to finally share it with you. @ShawnRyanShow
@Pampadalampa@dexscreener@CronosNetwork This is how much Tonic they would have had to buy at the ATH to be able to borrow $126million. NOT possible unless 20% ratio was adjusted to borrow at a higher interest rate. Tonic wonβt be fully minted until 2029/30. Wake up
@Pampadalampa@dexscreener@CronosNetwork Yeah, well I took almost 20B tonic out of lending to swap and they gave me 1.9Billion back after rollback, then dumped to try to liquidate the 170million VVS I had in the lending protocol. Make that make sense. Cocksuckers
@Pampadalampa@CronosNetwork@TectonicFi Rugpull from the start. Cronos is not a blockchain. Not when it can be changed to benefit Dev teams and shoves a cattle prod up the ass of legitimate investors
@kris Message me. I have proof of rugpull from Tonic dev team and they used cdc to get away with it. @SECGov@FBI they used the reversal to dump the tonic and investors couldnβt interact or sell before they dumped. Biggest Heist in Human history
@Pampadalampa@TectonicFi@SECGov@FBI@TectonicFi just stole over $126million from investors and used @cryptocom to do reversal so they could dump the tonic they ran up and prevented everyone from being able to interact/sell before they dumped.