The Cronos blockchain was brought to a halt on August 30 after an attacker exploited Tectonic, the chain's largest decentralized lending protocol, in a price-manipulation attack that on-chain
The Cronos blockchain was brought to a halt on August 30 after an attacker exploited Tectonic, the chain's largest decentralized lending protocol, in a price-manipulation attack that on-chain researchers estimate caused losses of up to $75 million.
The attacker manipulated the price of Tectonic's TONIC governance token roughly 100x in about 20 minutes, then borrowed against the inflated collateral to drain an estimated $66 million to $75 million from the protocol.Researcher Weilin Li said the attacker exploited TONIC's 20% collateral factor and thin liquidity, pumping the governance token's price 100-fold within 20 minutes before borrowing other assets.Li described it as a "Mango-market style" pump-and-borrow attack.
Li initially estimated losses at approximately $66 million, but that figure later rose to roughly $75 million after another attacker-controlled address containing about $8 million was identified.A separate on-chain analysis estimated approximately $119.5 million was withdrawn from affected pools during roughly 65 minutes.Before the attack, Tectonic held $121.7 million in TVL and $82.7 million in active loans.
The attacker managed to bridge only about $6 million to Ethereum before Cronos halted.Cronos uses a Tendermint Core BFT consensus alongside a proof-of-authority structure with an active validator set capped at 100, which enabled validators to coordinate the emergency halt and restrict the attacker's ability to transfer additional funds beyond Cronos.
Tectonic separately warned users not to interact with the protocol while it investigated.Neither project confirmed the root cause or final loss figure, and no restart timeline had been announced at the time of publication.
Crypto.com CEO Kris Marszalek said the firm's app and exchange were not compromised, and that Crypto.com's security team is assisting in the investigation.As of publication, no entity has committed to repaying Tectonic depositors.
Sources:The Block: Cronos network halts after Tectonic exploit estimated at $75 millionBlockonomi: Cronos Network Halts After Tectonic Price Exploit Triggers $75M LossBeInCrypto: Cronos Blockchain Stops After Reported $75 Million Hack Attempt
