- Cronos validators halted the Crypto.com-linked chain on Sunday after an exploit at Tectonic, the network’s largest lending protocol.
- Onchain researcher Weilin Li estimates about $75 million was affected after TONIC was pumped roughly 100x in 20 minutes and used as collateral.
- Only about $6 million was bridged to Ethereum before the halt; most remaining assets are stranded on Cronos.
- Tectonic TVL fell from about $121.7 million to roughly $3 million. Crypto.com said its app and exchange were not affected.
The Cronos blockchain halted block production on Sunday after validators identified an exploit at Tectonic, the network’s largest lending protocol. Onchain researcher Weilin Li estimated that roughly $75 million in assets was affected, though Tectonic has not confirmed a final loss figure or a root-cause analysis.
Li said the attacker inflated the price of Tectonic’s thinly traded governance token, TONIC, by about 100 times in 20 minutes, then posted the tokens as collateral and borrowed other assets from the protocol — a Mango Markets-style pump-and-borrow that exploited TONIC’s 20% collateral factor and shallow liquidity. CoinDesk reported that TONIC had about $1.34 million in liquidity and roughly $11,000 in daily volume before the attack.
Most of the funds never left the chain. Li said the attacker bridged only about $6 million to Ethereum before the halt, leaving the bulk of the haul stranded on Cronos. Lookonchain later reported that about $6.29 million reached Ethereum and was swapped for 2,592 ETH, with another $68.7 million still on the paused network.
Tectonic held about $121.7 million in total value locked and $82.7 million in active loans before the incident, according to DefiLlama data cited by The Block, or close to half of all DeFi deposits on Cronos. That TVL had fallen to roughly $3 million by Monday. In a separate post, Tectonic told users not to interact with the protocol until it confirmed it was safe to do so.
Crypto.com CEO Kris Marszalek said the incident was confined to the independent lending app. “There has been a security breach on a Cronos lending protocol Tectonic,” he wrote on X. “Crypto.com app and exchange were not affected and are operating as usual. All funds are safe.” Cronos, which was originally developed by Crypto.com and is capped at 100 validators, said on Monday it remained halted while security teams investigated and that no restart timetable had been set.
The pause trapped most of the attacker’s proceeds, but it also froze ordinary Cronos activity. Neither Cronos nor Tectonic has said whether they will restrict the attacker’s addresses, attempt a recovery, or compensate depositors. Those decisions, and any confirmed loss total, will determine how much of the estimated $75 million ultimately leaves the chain.
