Cronos Blockchain Halted After Attacker Drains $75 Million From Tectonic Lending Protocol

Cronos, the blockchain network originally developed by Crypto.com, took the unusual step of halting its entire chain after an attacker exploited Tectonic, the network’s largest lending protocol, in an attack preliminarily estimated at $75 million. The incident marks the third price-manipulation exploit of this specific style to hit DeFi lending protocols in recent months, following similar attacks on Moonwell and the reUSD/Pendle YT market. How the Attack Worked According to onchain researcher Weilin Li, who has been tracking the exploit in real time, the attacker manipulated the price of TONIC, Tectonic’s own governance token, before borrowing heavily against the artificially inflated collateral value. Li explained the underlying vulnerability plainly: “The root cause is simple: TONIC, it’s own governance token has a 20% collateral factor, with very thin liquidity. The attacker performed a Mango-market style pump-and-borrow price manipulation attack. TONIC’s price surged by 100x within 20 minutes.” The attack technique echoes the infamous 2022 Mango Markets exploit, in which an attacker used a similar strategy — artificially pumping the price of a low-liquidity token, then using the inflated valuation as collateral to borrow far more in other assets than the position was legitimately worth. In Tectonic’s case, allowing TONIC itself to be used as collateral at a 20% factor, combined with thin trading liquidity that made the token’s price easy to manipulate, created the exact conditions such an attack requires. The Race to Contain the Damage Cronos Network moved quickly once the exploit was detected, posting on X: “We identified an exploit in Tectonic. The Cronos Network has been halted and we’ll provide updates here.” The team later added it remained halted while investigating “with support from security teams across the industry.” That rapid response appears to have limited the attacker’s ability to move stolen funds off-chain. According to Li, the attacker managed to bridge only approximately $6 million to Ethereum before Cronos halted the network, leaving roughly $60 million still stranded on the Cronos chain itself. Notably, rather than attempting further transfers, the attacker deposited that $60 million into a decentralized exchange liquidity pool on Cronos — a move Li suggested may have been intended to avoid having the funds blacklisted or frozen. Li’s tracking identified three distinct wallet addresses tied to the exploit: one holding roughly $60 million on Cronos, another holding the $6 million bridged to Ethereum, and a separate borrow position wallet. Li later flagged a fourth address, a second attacker-controlled wallet holding an additional $8 million on Cronos, bringing the total estimated loss to approximately $75 million. Tectonic’s Response Tectonic confirmed the incident on X, stating: “We are aware of an incident affecting Tectonic and our team is actively investigating.