Hassan Maishera
TL;DR
-
Cronos halted its blockchain on Sunday following an exploit targeting Tectonic, the network’s largest lending protocol.
-
An onchain researcher estimates that approximately $75 million in assets were affected, although Cronos and Tectonic have not confirmed the figure.
-
The attacker allegedly manipulated Tectonic’s low-liquidity TONIC token to roughly 100 times its previous price and used it as inflated collateral.
Cronos Blockchain Halted Following Tectonic Attack
Cronos suspended its blockchain operations on Sunday after identifying an exploit affecting Tectonic, the network’s largest decentralized lending protocol.
“We identified an exploit in Tectonic,” Cronos Network said in a post on X. “The Cronos Network has been halted, and we’ll provide updates here.”
We identified an exploit in Tectonic.
— Cronos Network (@CronosNetwork) August 30, 2026
The Cronos Network has been halted and we'll provide updates here
Tectonic separately confirmed that it was investigating an incident and advised users to avoid interacting with the protocol until further notice.
The project has not disclosed the cause of the exploit or confirmed the amount of assets affected.
Before the incident, Tectonic held approximately $121.7 million in total value locked and had around $82.7 million in active loans, according to DefiLlama.
Onchain researcher Weilin Li attributed the exploit to price manipulation involving TONIC, Tectonic’s thinly traded governance token.
According to Li, the attacker pushed TONIC’s price up by approximately 100 times within 20 minutes. The inflated tokens were then deposited into Tectonic as collateral, allowing the attacker to borrow other assets from the lending protocol.
The strategy resembles the oracle-manipulation attack that drained more than $100 million from Mango Markets in 2022.
Price oracles provide blockchain applications with external market data. When an asset has limited liquidity, an attacker may be able to manipulate its market price and cause a lending protocol to assign an artificially high value to the asset.
Tectonic’s own documentation warns that low-liquidity assets can be particularly vulnerable to this type of manipulation.
TONIC Collateral Reportedly Enabled $75 Million in Borrowing
Tectonic assigns TONIC a collateral factor of 20%. This means users can borrow assets worth up to 20% of the value of the TONIC deposited as collateral.
Li identified approximately 364.6 trillion TONIC tokens in the attacker’s position. For those tokens to support $75 million in borrowing, Tectonic would have needed to value the collateral at roughly $375 million.
That would place TONIC’s price at approximately $0.00000103 per token—about 100 times its price near the pre-attack low, according to CoinGecko data.
The calculation broadly supports Li’s assessment that the attacker manipulated TONIC’s value upward before borrowing assets from the protocol.
Li initially estimated that the attacker obtained around $66 million. The researcher later identified a second address believed to be controlled by the same attacker containing approximately $8 million, raising the total estimate to roughly $75 million.
Neither Cronos nor Tectonic has independently confirmed those calculations.
The attacker managed to bridge only around $6 million to Ethereum before Cronos halted the blockchain, according to Li.
If accurate, the intervention prevented most of the affected assets from leaving the Cronos network. However, the funds remaining on Cronos could become movable again once block production resumes unless the network takes additional action.
Cronos has not explained whether it plans to freeze the attacker’s addresses, reverse transactions, or pursue another recovery mechanism before restarting the network.
The decision to halt a blockchain can limit immediate losses but may also create questions about decentralization, transaction finality, and the authority of network operators to intervene during security incidents.
Crypto.com Says its Services were not Compromised
Crypto.com CEO Kris Marsalek said the company’s application and exchange were not affected by the incident.
He added that Crypto.com’s security team is assisting Cronos with its investigation.
Cronos was originally developed by Crypto.com, while Tectonic operates as an independent decentralized finance platform on the blockchain. Tectonic was also the network’s first DeFi lending protocol.
The investigation therefore appears to be focused on Tectonic’s lending markets and the pricing mechanism used for TONIC collateral rather than Crypto.com’s centralized products.
The Tectonic exploit comes days after Moonwell, a lending protocol operating on Base, suffered a comparable incident.
An attacker reportedly manipulated the collateral price of MAMO, another relatively illiquid token, causing an estimated $8.7 million in losses.
Li also highlighted an August 25 incident involving a thinly traded Pendle market. Price manipulation reportedly triggered approximately $36 million in liquidations of leveraged PT-reUSD positions on Morpho.
The incidents demonstrate the risks of accepting low-liquidity tokens as collateral. Even when lending protocols apply conservative collateral factors, manipulated oracle prices may allow attackers to borrow substantial amounts against assets that have little genuine market depth.
