Cronos Network Halts After Apparent $75 Million Tectonic Exploit

The Cronos blockchain stopped producing blocks Sunday after an attacker exploited Tectonic, the network’s largest lending protocol, in what one researcher estimates at roughly $75 million in affected assets.

Cronos is the blockchain chain tied to exchange Crypto.com. Tectonic, an independent DeFi lending protocol built on top of it, held about $121.7 million in total value locked and $82.7 million in active loans before the incident, per DefiLlama. Onchain researcher Weilin Li puts the affected amount near $75 million. Tectonic has not confirmed that figure.

Cronos Network said on X that it had “identified an exploit in Tectonic” and halted the chain. Tectonic told users not to interact with the protocol until it confirms it is safe. Neither has disclosed a restart timeline. Crypto.com chief executive Kris Marsalek said the exchange’s app and trading platform were not compromised and that Crypto.com’s security team is assisting Cronos with the investigation.

Li attributes the exploit to manipulation of TONIC, Tectonic’s thinly traded governance token. The token climbed roughly a hundredfold inside 20 minutes, according to Li’s analysis. The attacker then posted the inflated TONIC as collateral and borrowed against it. Pump a low-liquidity token, use it to drain a lending pool. The pattern matches the 2022 Mango Markets oracle attack on Solana, which Li and others have repeatedly cited as a template for this class of exploit.

Tectonic’s own documentation warns that low-liquidity assets are susceptible to price manipulation. TONIC carries a 20% collateral factor in the protocol’s money-market parameters. Borrowers can draw loans equal to one-fifth of posted TONIC value. Li identified an attack position holding 364.6 trillion TONIC. To support $75 million in borrowing at that factor, the tokens would need to be valued near $375 million, or about $0.00000103 each. That is roughly a hundred times the token’s pre-attack price on CoinGecko.

Li initially estimated the loss at about $66 million. Then he flagged a second attacker-controlled address holding roughly $8 million, bringing the total near $75 million. Only around $6 million is believed to have reached Ethereum via a bridge before Cronos halted, Li said. What happens to the remaining assets once the chain resumes has not been disclosed.

The episode lands amid a cluster of similar attacks. Three days earlier, the Moonwell protocol on Base lost about $8.7 million after an attacker manipulated the price of its MAMO token to borrow against inflated collateral. Li also flagged a 2025 Resupply incident that cost $9.5 million and followed the same playbook. Traders, as ever, disagree on whether these are copycats or the same neglected parameter setting getting found by different hands.

What remains unknown: the full root cause, an independently confirmed loss figure, and a plan from Cronos for how it restarts. Tectonic has not confirmed Li’s $75 million estimate or named a specific attack vector. Cronos has not said whether it will coordinate a state rollback, freeze bridged funds, or take no recovery action at all. Marsalek’s post is the only statement from the Crypto.com side beyond the chain’s own announcement. Tectonic’s last public instruction was to stand clear of the protocol.