Crypto.com-linked Cronos network halts after Tectonic exploit estimated at $75 million

The Cronos blockchain was halted on Sunday after an exploit hit Tectonic, the network's biggest decentralized lending protocol, with an onchain researcher estimating that roughly $75 million in assets were affected.

Cronos Network confirmed the incident in a post on X, saying it had identified an exploit in Tectonic and that the chain had been stopped, with further updates to follow. Tectonic said separately that it was aware of an incident and that its team was investigating, urging users to stay away from the protocol until it confirms operations are safe. Before the attack, Tectonic held about $121.7 million in total value locked and roughly $82.7 million in active loans, according to DefiLlama. The protocol has not yet confirmed how much was lost or what caused the breach.

TONIC price manipulation

Onchain researcher Weilin Li attributed the exploit to manipulation of TONIC, Tectonic's thinly traded governance token. According to Li, the attacker drove TONIC's price up roughly 100-fold within 20 minutes and then used the inflated tokens as collateral to borrow other assets from the protocol — a mechanism similar to the 2022 oracle-manipulation attack on Mango Markets. Tectonic's published money-market parameters assign TONIC a 20% collateral factor, meaning deposits of the token can back borrowing worth up to one-fifth of their value. Based on the roughly 364.6 trillion TONIC tokens Li identified in the attack position, those tokens would need to be worth about $375 million — near $0.00000103 each — to support the estimated $75 million in borrowing, about 100 times TONIC's pre-attack low as recorded by CoinGecko. Tectonic's own documentation warns that low-liquidity assets are especially vulnerable to price manipulation.

Li first put the attacker's haul at about $66 million, then found another attacker-controlled address holding roughly $8 million, bringing the total to approximately $75 million. He added that the attacker managed to bridge only around $6 million to Ethereum before Cronos was halted, leaving most of the affected assets stranded on the network. Neither Tectonic nor Cronos has independently confirmed Li's figures.

Crypto.com CEO Kris Marszalek said in a post on X that the company's app and exchange were not compromised and that Crypto.com's security team is helping Cronos with the investigation. Cronos was originally developed by Crypto.com, while Tectonic runs as an independent DeFi lending platform and was the network's first such protocol.

The event echoes recent collateral-manipulation attacks. Li pointed to Moonwell, a lending protocol on Base, which lost an estimated $8.7 million three days earlier after an attacker manipulated the price of the illiquid MAMO token, and to an Aug. 25 case in which manipulation of a thinly traded Pendle market triggered about $36 million in liquidations of leveraged PT-reUSD positions on Morpho. Cronos has not yet outlined a plan for restarting the chain or said what will happen to the attacker's assets once it does.