Cronos Hit Pause, Not Tectonic: $75M Frozen Mid-Heist 🧊

Cronos halted its entire blockchain on Sunday after an attacker exploited decentralized lending protocol Tectonic in what onchain researcher Weilin Li described as a "Mango-market style pump-and-borrow price manipulation attack," draining an estimated $75 million. Cronos Network said it "identified an exploit in Tectonic," stopped block production and promised updates. The chain remained halted a day later, with Cronos stating it was investigating "with support from security teams across the industry."

The exploit hinged on Tectonic assigning its own governance token TONIC a 20% collateral factor despite roughly $1.34 million in liquidity, according to Li. He said TONIC's price surged 100-fold within 20 minutes before the attacker borrowed against it. Li initially estimated losses at $66 million, then revised the figure upward to roughly $75 million after identifying a second attacker-controlled address holding about $8 million on Cronos. Security firm PeckShield put the total at approximately $74 million.

Tectonic is the dominant lending market on Cronos. DefiLlama data shows it held about $121.7 million in deposits and $82.7 million in active loans shortly before the incident, close to half of all capital in Cronos DeFi. The next-largest lender on the chain, Mimas Finance, holds about $30,000. By Monday, DefiLlama TVL had fallen to roughly $3 million, a decline of 97.5% over 30 days, while a separate onchain analysis measured gross outflow from the pools at about $119.5 million.

The halt contained the damage. Only about $6 million of the proceeds reached Ethereum before block production stopped, Li said, leaving roughly $60 million stranded on Cronos. Crypto.com CEO Kris Marszalek confirmed that the Crypto.com app and exchange were "not affected and are operating as usual," with "all funds safe." Cronos runs on Tendermint with a cap of 100 validators, a structure that makes a coordinated pause feasible; a precedent cited by analysts is the October 2022 BNB Chain bridge exploit, when 26 validators halted the network within five hours and recovered close to $470 million of a roughly $570 million mint.

Cronos and Tectonic have not confirmed the cause or loss, announced a restart timeline, said whether they will restrict the attacker's addresses, recover assets, or compensate affected users, and have not commented on whether the $60 million immobilised on the chain can be clawed back. CRO token price remained largely unaffected, rising nearly 5% on the day, and Crypto.com separately said no exchange user funds were exposed, with a full postmortem to follow.