Key Takeaways
- Cronos halted block production on Aug. 30 after an exploit hit Tectonic, the network’s largest lending protocol.
- Onchain researcher Weilin Li estimates the attacker manipulated TONIC’s price roughly 100-fold in 20 minutes before borrowing about $75 million against the inflated collateral.
- Only around $6 million reached Ethereum before the halt, while Crypto.com says its exchange, app and customer funds were not affected.
Cronos took the unusual step of halting its entire blockchain on Sunday, Aug. 30, after a suspected price manipulation attack targeted Tectonic, its largest decentralized lending protocol.
The attack affected an estimated $75 million, although neither Tectonic nor Cronos has confirmed the final loss or published a complete post-mortem.
Most of the suspected proceeds remained trapped on Cronos after validators stopped the network.
Before the incident, Tectonic held roughly $121.7 million in total value locked and $82.7 million in active loans. By Monday, its TVL had fallen to around $3 million, according to DefiLlama data.
How the $75M Tectonic Attack Worked
The apparent weakness was not a conventional smart contract drain.
Onchain researcher Weilin Li said the attacker targeted TONIC, Tectonic’s thinly traded governance token, and pushed its price roughly 100 times higher within about 20 minutes.
The attacker then deposited the artificially inflated TONIC into Tectonic as collateral and borrowed higher-value assets against it.
That was possible because TONIC had a 20% collateral factor. In other words, every $100 of TONIC value recognized by the lending protocol could support approximately $20 of borrowing.
The risk was amplified by TONIC’s shallow market. Reportedly, the token had only about $1.34 million in liquidity and roughly $11,000 in daily trading volume, making its market price easier to move than a heavily traded asset.
Li initially estimated around $66 million had been affected before identifying another attacker-controlled address holding roughly $8 million, raising his estimate to approximately $75 million.
Cronos Halt Traps Most of the Funds
The attacker did not manage to move most of the assets away.
Li estimated that only about $6 million was bridged to Ethereum before Cronos stopped block production, leaving the majority of the suspected proceeds stranded on the chain.
That could improve the chances of recovering some assets, but it creates another difficult question: what Cronos validators do with the funds when the network restarts.
As of Monday morning, Cronos had not announced a restart timetable or explained whether it could freeze, recover or otherwise deal with the attacker’s remaining assets.
Crypto.com Says Exchange Funds Are Safe
Cronos confirmed the incident on Aug. 30, saying it had “identified an exploit in Tectonic” and halted the network while investigating.
Tectonic separately warned users not to interact with the protocol until it confirms operations are safe.
Crypto.com CEO Kris Marszalek also responded, saying the Crypto.com security team was assisting with the investigation. He stressed that the Crypto.com app and exchange were not affected and were operating normally, adding that customer funds were safe.
The $75 million figure remains preliminary. What happens to the funds still sitting on Cronos, and how validators restart the chain, will now determine how much of the apparent loss becomes permanent.
Crypto Security Remains a Major Problem in 2026
The Tectonic attack is the latest in a string of exploits showing that crypto security remains a major problem.
On Aug. 28, 1,685 Avici users lost about $500,000 after a vulnerability affected card balances held in a third-party Solana contract, although the company said its self-custody wallets were untouched.
Just days earlier, Term Finance lost an estimated $8.5 million in a governance exploit, while Maya Protocol halted MAYAChain after an attacker exploited a chain of software flaws to extract roughly $1.7 million, contributing to an estimated $10.9 million drop in the liquidity pool’s value.
On Aug. 27, ICON Network was also hit by a replay exploit that repeatedly replayed previously signed withdrawal messages; the foundation said user funds were not affected, and much of the exploited ICX was frozen on exchanges.
These incidents show that recent losses stem from very different weaknesses, including price-oracle manipulation, governance controls, contract logic, and third-party infrastructure, rather than a single common attack method.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
