Cronos Hit Pause on $75M Heist—Only $6M Made It Out the Door 🚪

Cronos Network halted block production on Sunday after an exploit on lending protocol Tectonic drained an estimated $75 million, with roughly $60 million left immobilized on the chain before validators pulled the plug. Cronos Network said in a post on X that it had "identified an exploit in Tectonic," that the Cronos Network had been halted, and that updates would follow. Tectonic separately told users not to interact with the protocol while it investigated.

Onchain researcher Weilin Li described the attack as a "Mango-market style pump-and-borrow price manipulation attack," referring to the $100 million exploit of Mango Markets in October 2022. Li said the attacker exploited TONIC's 20% collateral factor and thin liquidity, pumping the governance token's price 100-fold within 20 minutes before borrowing against it. Li initially estimated $66 million was affected, then revised the figure to roughly $75 million after identifying another attacker-controlled address holding about $8 million. Security firm PeckShield put the total at approximately $74 million. Cronos Network said the network remained halted as of Monday and was investigating "with support from security teams across the industry."

Only about $6 million of the proceeds was bridged to Ethereum before the pause, Li said, leaving roughly $60 million stuck on a chain that has not produced blocks since. Cronos CEO Kris Marszalek said the company's app and exchange were unaffected and operating normally and that funds there were safe. Neither Cronos nor Tectonic has confirmed the cause of the exploit, the final loss figure, or whether Tectonic depositors will be repaid.

Tectonic launched in December 2021 out of the Cronos Labs incubator and is not Crypto.com code, making the exchange's reassurance technically accurate but narrow in scope for DeFi users. DefiLlama data shows Tectonic held about $121.7 million in deposits and $82.7 million in active loans shortly before the incident, close to half of all capital in Cronos DeFi, while the next-biggest lender, Mimas Finance, held about $30,000. By Monday Tectonic's total value locked had collapsed to roughly $3 million, a 97.5% decline over 30 days. An on-chain analysis using a Cronos archive node estimated that about $119.5 million was drained from lending pools in 65 minutes, recording 752 liquidations involving roughly $8.71 million seized from other users and about $32.6 million in bad debt left behind.

The halt itself was made possible by the chain's architecture. Cronos runs on Tendermint with a cap of 100 validators, a setup that makes a coordinated pause realistic, and there is precedent for it: a bridge exploit minted $570 million on BNB Chain in October 2022, after which 26 validators paused the network within five hours and recovered close to $470 million.