Tectonic Attack Involves $120.4M; About $9.19M Unrecovered

Tectonic, the Cronos-based decentralized lending market, disclosed an attack involving $120.4 million, of which about $9.19 million remains unrecovered, according to unconfirmed reports that have not yet been matched to a readable primary incident disclosure. The two figures frame the scale of the event, but the supplied material stops short of a full accounting of what was lost, secured, or returned. Tectonic describes itself as a decentralized lending and borrowing protocol on Cronos, where suppliers deposit supported tokens to earn interest and borrowers must post collateral worth more than the amount they draw, per the project's own documentation. The protocol says its design is inspired by Compound, the overcollateralized money market model that underpins much of on-chain lending. For related coverage, see PolyNext Awards & Conference Dubai 2026: Advancing the Global Dialogue on Plastic Recycling and Circularity. The headline figure of roughly $120.4 million is described as the amount involved in the attack, not a confirmed sum stolen or a final net loss, according to unconfirmed reports. About $9.19 million is characterized as still unrecovered, a qualifier that leaves the valuation time, the definition of recovery, and any subsequent status unspecified. For related coverage, see Abraxas Capital Reportedly Buys 13,000 ETH. Why the amount involved is not the amount lost The distinction between the two numbers matters. Subtracting the unrecovered sum from the amount involved yields approximately $111.21 million, but that is arithmetic on two rounded headline figures, not evidence of confirmed recoveries, frozen funds, or reimbursed users. For related coverage, see Boyaa Interactive Adds 115 Bitcoin, Holdings Reach 4,316. Nothing in the supplied material establishes how much was recovered, secured, or returned, or on what date any of the values were measured. Treating the difference as recovered capital, or treating the smaller figure as a finalized loss, would overstate what the disclosure actually supports. What remains unconfirmed The supplied reporting does not specify the attack mechanism, the incident date, the affected assets, the number of impacted users, or any recovery actions taken. These gaps reflect the limits of the available material rather than a confirmed decision by Tectonic to withhold details publicly. Attributing responsibility or describing an exploit path would require a primary disclosure or a technical incident report, neither of which is present here. On-chain movements tied to the incident are unverified in the supplied material; activity such as how a Tectonic attacker routed ETH through Tornado Cash would need to be traced to block-explorer records before being folded into any accounting. Tectonic's contract directory lists the TONIC CRC20 token and the TectonicCore contract with Cronoscan links, reachable from its official homepage, but a protocol contract address is not an identified exploit transaction, and no exploit hash has been established in the supplied material.