Kronos DAO

Insider Manipulation

Estimated loss

—

VERDICT —OUT OF SCOPE

Root cause is social engineering — privileged personnel deceived into authorizing the drain. Contract behaved as written. Defense lives in process controls (multi-party approval, M-of-N signoff windows), not in smart-contract review.

▰ METHOD

SOCIAL ENGINEERING

SOCIAL-ENGINEERING

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

According to Pinpoint News, Klaytn-based DeFi project Kronos DAO misappropriated users’ DAI pledged in its vaults to invest in Kairos Cash and lost 6 million DAI. The 6 million DAI staked by users turned into 6 million Kairos Cash in the Kronos Dao Vault, which Kronos Dao explained was “used as a strategic investment.” Investors, however, questioned that the explanation was insufficient and that no advance notice was given. At present, Kronos Dao has closed Kakao Talk and Telegram communication channels, leaving only Discord as a communication channel. Attack method (per SlowMist): Insider Manipulation. Reported loss: 6,000,000 DAI.

Primary source

https://www.pinpointnews.co.kr/news/articleView.html?idxno=117157 ↗

Sourced from

slowmist

Technical record