Cronos Blockchain Halts After Reported $75M Tectonic Exploit

The Cronos blockchain was halted on Sunday following a suspected exploit involving Tectonic, the network's largest decentralized lending protocol, with an on-chain researcher estimating approximately $75 million in assets were affected.

Cronos confirmed that it had identified an exploit involving Tectonic and halted the network while investigating the incident. Tectonic separately acknowledged a security issue and advised users not to interact with the protocol until it confirms operations are safe.

Neither Cronos nor Tectonic has officially confirmed the total amount affected or provided a complete explanation of the exploit.

Before the incident, Tectonic held approximately $121.7 million in total value locked and $82.7 million in active loans, according to DeFiLlama data cited in reports.

TONIC Price Reportedly Manipulated 100x

On-chain researcher Weilin Li attributed the incident to price manipulation involving TONIC, Tectonic's relatively illiquid governance token.

According to Li's analysis, the attacker allegedly pushed TONIC's price approximately 100 times higher within about 20 minutes. The artificially inflated tokens were then deposited as collateral, allowing the attacker to borrow more valuable assets from Tectonic.

The mechanism resembles previous oracle and collateral manipulation attacks, including the 2022 Mango Markets exploit, where manipulated asset prices enabled oversized borrowing positions.

Tectonic's published market parameters give TONIC a 20% collateral factor, meaning users can borrow assets worth up to 20% of the value of deposited TONIC.

Researcher Estimates $75 Million Was Affected

Li identified approximately 364.6 trillion TONIC tokens in the suspected attack position. For that collateral to support around $75 million in borrowing, it would need to have been valued at roughly $375 million.

That translates to approximately $0.00000103 per TONIC, around 100 times the token's price near its pre-incident low. The calculation broadly supports Li's claim that TONIC was dramatically inflated before being used as collateral.

Li initially estimated that the attacker had received approximately $66 million in assets. He later identified another suspected attacker-controlled address containing around $8 million, increasing the estimated total to approximately $75 million.

However, these figures remain unconfirmed by both Tectonic and Cronos, meaning the final loss could change as the investigation progresses.

Network Halt May Have Trapped Most Assets

Although the suspected borrowing position was enormous, the decision to halt Cronos may have prevented most of the assets from leaving the blockchain.

According to Li, the attacker managed to bridge only around $6 million to Ethereum before Cronos stopped producing blocks. If accurate, the majority of the approximately $75 million in affected assets could remain on Cronos.

That creates uncertainty over what happens when the blockchain resumes operations. Cronos has not yet disclosed when the network will restart or how the suspected attacker's remaining assets will be handled.

Crypto.com CEO Kris Marsalek said the company's app and exchange were not compromised. He added that Crypto.com's security team was assisting Cronos with the investigation.

Cronos was originally developed by Crypto.com, while Tectonic operates independently as a DeFi lending protocol and was the first lending platform launched on the network.

DeFi Faces Wave of Price Manipulation Incidents

The suspected Tectonic attack follows several recent incidents involving thinly traded assets being used within DeFi lending and leveraged markets.

Just three days earlier, Base-based lending protocol Moonwell suffered an estimated $8.7 million exploit involving manipulation of the illiquid MAMO token. The attacker allegedly inflated MAMO's value before using it as collateral to borrow more liquid assets.

Li also highlighted an August 25 incident involving a thinly traded Pendle market. Price manipulation reportedly triggered approximately $36 million in liquidations involving leveraged PT-reUSD positions on Morpho.

Together, the incidents highlight the risks created when lending protocols accept illiquid tokens as collateral while relying on prices that can potentially be manipulated with concentrated trading activity.

For Cronos and Tectonic, major questions remain unanswered. Investigators still need to determine the precise mechanism, calculate the final losses and establish whether affected funds can be recovered.

Most importantly, Cronos has yet to announce a restart plan for the blockchain. With most of the suspected assets reportedly unable to leave the network before the halt, what happens when Cronos resumes could determine the ultimate financial impact of one of the largest reported DeFi incidents of 2026.