Cronos Halts Blockchain After Tectonic Exploit Worth Around $75 Million: Full Account and Implications
Table of Contents
You might want to know
1. How did an attacker extract roughly $75 million from Cronos’ largest lending protocol, Tectonic?
2. Why did Cronos stop producing blocks, and what were the immediate consequences for users and other DeFi apps on the chain?
Main Topic
On Sunday, the Cronos network halted block production after an exploit targeted Tectonic, the largest decentralized lending protocol on the chain. Tectonic allows users to deposit tokens that others can borrow against, earning interest for depositors. Because Tectonic was the first and by far the largest lending application on Cronos, it held a large share of the network’s DeFi capital—roughly half of deposits across Cronos DeFi apps—making the impact unusually wide-reaching.
An onchain researcher estimated the attacker’s proceeds at about $75 million, while security firm PeckShield estimated a similar figure near $74 million. Investigators found that approximately $6 million was bridged out to Ethereum before Cronos stopped block production; the remainder was left stuck on the halted chain. A separate onchain analysis reported larger gross outflows from pools, around $119.5 million, which measures all funds moved rather than net attacker proceeds.
Researchers characterized the exploit as a price-manipulation and borrow-style attack akin to the 2022 Mango Markets incident. According to analyst Weilin Li, the attacker rapidly pumped the price of Tectonic’s governance token (TONIC), which surged roughly 100-fold in about 20 minutes. Because Tectonic had assigned the TONIC token a 20% collateral factor despite very thin liquidity—TONIC liquidity was on the order of $1.34 million—this allowed the attacker to borrow a disproportionate amount against the manipulated valuation. The low liquidity meant modest trades produced large price moves, enabling the attack.
The halt was intended to contain the attack. Cronos runs a capped validator set (100 validators), which allowed coordinators to stop block production quickly. That quick containment limited the bridge out to approximately $6 million, but it also froze every active position on the network. Open loans, automated strategies, trades and payouts—even those unrelated to Tectonic—stopped until the chain could be restarted. The trade-off was therefore containment at the cost of temporarily immobilizing legitimate user funds and activity.
At the time of the incident, Tectonic held roughly $121.7 million in deposits and $82.7 million in outstanding loans, according to DefiLlama. Those figures represented nearly half of all DeFi capital on Cronos. Within a 30-day period preceding the incident, Tectonic’s deposits had already collapsed dramatically, a decline reflected in DefiLlama’s data and consistent with the systemic fragility of the network’s largest lending market. Earlier incidents on Tectonic—recorded as protocol logic failures in 2024—underscore prior vulnerabilities; this attack was classified differently by analysts as oracle manipulation via spot-price manipulation.
Crypto.com’s exchange and mobile app were reported to be unaffected by the chain halt; the company’s CEO stated that customer funds on the exchange were safe and promised a postmortem. Tectonic advised users to avoid interacting with the protocol until it confirmed safety. Cronos said it was investigating with support from security teams across the industry but did not provide a restart timeline or a final loss figure, nor did it confirm whether depositors would be compensated.
The attack was described by observers as the third Mango-style manipulation in recent weeks, following similar incidents on other chains and protocols. These events illustrate a recurring pattern where illiquid governance or reward tokens are used as collateral with unrealistic collateral factors, enabling attackers to manipulate prices and extract large sums. The broader DeFi landscape has seen comparable exploits where price or oracle manipulation coupled with risky collateral logic produces outsized losses.
In containment terms, the halt achieved its immediate goal: preventing a larger amount of funds from being bridged away. However, the pause introduced a host of secondary problems: user positions remained frozen, and the chain’s DeFi economy stopped functioning pending investigation. The incident also raised governance and risk-management questions about token collateralization policies, oracle security, and the dangers of permitting protocol-owned tokens or thinly traded assets to serve as sizable collateral classes.
Key Insights Table
| Aspect | Description |
|---|---|
| Exploit Type | Price-manipulation pump-and-borrow attack targeting TONIC token liquidity and collateral factors. |
| Estimated Loss | ~$74–75 million in attacker proceeds; ~$6 million bridged to Ethereum before the halt. |
| Containment Action | Cronos halted block production across the network to limit fund outflows. |
| Impact on Users | All DeFi positions froze, affecting unrelated loans, trades, and automated strategies. |
| Protocol Context | Tectonic was the largest lending protocol on Cronos, holding a disproportionate share of chain liquidity. |
Afterwards...
Moving forward, several areas deserve attention from developers, security teams and policymakers. First, protocol design should avoid assigning high collateral factors to tokens with thin market depth; doing so repeatedly appears to be a primary enabler of pump-and-borrow attacks. Second, oracle models and price feeds must be hardened against manipulation—diversifying sources, using TWAPs (time-weighted average prices) where appropriate, and limiting instant single-block price reliance can reduce exploit risk.
Third, cross-chain bridging and withdrawal limits should be considered as part of emergency response planning. The ability to quickly isolate or delay outbound transfers can limit attacker exfiltration without resorting to full chain halts if combined with pre-established governance and emergency procedures. Fourth, more robust incident-response collaborations between projects, security firms, and validator sets can speed containment while preserving user access when possible.
Finally, the broader community should explore improved standards for token economics, risk assessment, and onchain insurance or compensation frameworks so depositors are not left without recourse after severe breaches. These steps—carefully implemented—can strengthen resilience across DeFi ecosystems while preserving the innovation that drives them. Ongoing research into oracle reliability, automated circuit-breakers, and decentralized dispute-resolution mechanisms remains especially important.