Cronos brought its entire blockchain to a stop over the weekend after attackers drained an estimated $75 million from Tectonic, a decentralized lending protocol built on the network. According to reporting by Cointelegraph, the chain was paused on Sunday once the Cronos team identified the exploit, and the project promised further updates as it worked to contain the damage.
Tectonic issued its own warning, urging users to stop interacting with the protocol while an investigation was underway. As of publication, neither Cronos nor Tectonic had confirmed the precise cause of the breach or a final tally of the losses, and no timeline for restarting the network had been shared.
The freeze appears to have limited how much value left the ecosystem. Cointelegraph reported that roughly $6 million was bridged to Ethereum before the halt took effect, while about $60 million of the stolen funds remained on Cronos itself. Researchers later flagged an additional $8 million sitting in an address tied to the attacker.
How the attack worked
Security researcher Weilin Li characterized the incident as a “Mango-market style” pump-and-borrow attack, a reference to a well-known category of exploit in decentralized finance. According to Li’s account cited by Cointelegraph, the attacker took advantage of the 20% collateral factor on Tectonic’s TONIC governance token combined with thin market liquidity. By inflating the token’s price roughly 100-fold in about 20 minutes, the attacker was able to borrow other assets against the artificially pumped collateral before the position could be unwound.
That mechanism — manipulating the value of a lightly traded token that a protocol accepts as collateral, then borrowing far more than the token is really worth — has become a recurring theme in DeFi exploits, and it once again exposed how thin liquidity can turn a governance token into an attack surface.
Crypto.com says its services are unaffected
Cronos is closely associated with Crypto.com, and the exchange moved quickly to reassure users. Cointelegraph reported that Crypto.com’s chief executive said the company’s app and exchange were operating normally and had not been affected by the Tectonic exploit. That distinction matters for users trying to gauge their exposure: the compromised protocol is a third-party application on Cronos rather than the exchange’s core custodial services.
Still, halting an entire layer-1 blockchain is a drastic step, and it leaves open questions the projects had not answered at the time of reporting. There were no announced decisions on whether stolen assets would be frozen or clawed back, whether affected users would be compensated, or when normal block production would resume.
For now, the episode adds Tectonic to a long list of lending protocols undone by collateral manipulation, and it puts the spotlight back on the trade-offs of running permissionless financial software at scale.
Written for Red Robot with AI assistance and human editing. Based on reporting by Cointelegraph.
