TheBlock
The Cronos blockchain halted on Sunday after an exploit on Tectonic, the network's largest lending protocol, drained an estimated $75 million in assets according to onchain researcher Weilin Li. The attacker pumped TONIC, Tectonic's thinly traded governance token, roughly 100x in 20 minutes and used the inflated balance as collateral to borrow other assets from the protocol, an attack vector structurally identical to the 2022 Mango Markets oracle-manipulation exploit. Pre-incident, Tectonic held about $121.7 million in total value locked and $82.7 million in active loans per DefiLlama data.
Why it matters
The exploit fits a pattern that has now produced three notable DeFi incidents in roughly a week. Li also flagged an Aug. 25 manipulation of a thinly traded Pendle market that triggered about $36 million in liquidations of leveraged PT-reUSD positions on Morpho, and a Moonwell exploit on Base three days earlier that lost an estimated $8.7 million via the same MAMO-token collateral manipulation. Lending protocols continue to assign non-trivial collateral factors to governance tokens with shallow liquidity, leaving a structural exposure that price oracles cannot reliably defend against when a single actor controls enough of the float.
Tectonic itself documents the risk: its published money-market parameters disclose that low-liquidity assets can be particularly susceptible to price manipulation. TONIC carried a 20% collateral factor, meaning the protocol allowed borrowing up to 20% of the token's deposited value. To support the $75 million in borrows, the attacker needed TONIC marked at roughly $375 million, or about $0.00000103 per token, versus a pre-attack price roughly 1% of that level.
Market impact
Cronos halted the entire network to prevent the attacker from bridging out the bulk of the proceeds. Li said only about $6 million made it to Ethereum before the chain stopped; the remaining $69 million sits in attacker-controlled addresses on Cronos awaiting a restart decision. Crypto.com CEO Kris Marsalek said the firm's app and exchange were not compromised and that Crypto.com's security team is assisting the investigation.
Frequently asked questions
-
What happened to Tectonic on the Cronos network?
Tectonic, Cronos's largest lending protocol, was exploited on Sunday in an incident an onchain researcher estimates drained about $75 million in assets. Cronos halted the entire blockchain to prevent the attacker from bridging out the proceeds.
-
How did the attacker exploit Tectonic?
The attacker pumped TONIC, Tectonic's thinly traded governance token, roughly 100x in 20 minutes, then used the inflated balance as collateral to borrow other assets from the protocol. The mechanic mirrors the 2022 Mango Markets oracle-manipulation exploit.
-
How much was taken in the Tectonic exploit?
Onchain researcher Weilin Li estimated about $75 million total, made up of roughly $66 million in the main attacker position plus about $8 million at a second attacker-controlled address. The figure has not been independently confirmed by Tectonic or Cronos.
-
Has the Cronos network restarted after the Tectonic exploit?
No. Cronos halted the chain on Sunday and has not disclosed a restart plan or explained what will happen to the attacker's frozen balances once the network resumes. Roughly $6 million bridged to Ethereum before the halt, with the rest stuck on Cronos.
-
Is Crypto.com affected by the Tectonic exploit on Cronos?
Crypto.com CEO Kris Marsalek said the firm's app and exchange were not compromised and that Crypto.com's security team is assisting the Cronos investigation. Cronos was originally developed by Crypto.com, but Tectonic operates as an independent DeFi lending protocol on the network.
CoinDesk
CryptoSlate
Crypto Rank News
WuBlockchain