Tectonic Attack Leaves Cronos Halted as Loss Estimate Reaches $75M

Cronos halted its blockchain on Sunday after an exploit targeting decentralized lending protocol Tectonic involved an estimated $75 million, according to on-chain researcher Weilin Li. Most of the affected funds remained on the Cronos network at the time of publication, and neither Cronos nor Tectonic had confirmed the cause or final loss figure.

What Happened in the Tectonic Exploit

Cronos said it identified an exploit in Tectonic and halted the network, promising further updates as the investigation continued. Tectonic separately warned users not to interact with the protocol while its team investigated.

Li said the attacker exploited TONIC’s 20% collateral factor combined with the token’s thin liquidity, pumping its price roughly 100-fold within 20 minutes before using the inflated position to borrow other assets from the protocol. Li described the mechanics as a Mango-market-style pump-and-borrow attack.

Li’s estimate of the damage moved in stages as more on-chain data surfaced. He initially put the affected amount at $66 million, noting that about $6 million had been bridged to Ethereum before the halt took effect, leaving roughly $60 million still on Cronos. He later identified another attacker-controlled address holding approximately $8 million, pushing his running estimate to roughly $75 million.

Those figures are Li’s independent reconstruction rather than confirmed numbers from Cronos or Tectonic. Neither project had verified the attack vector, the total loss, or how much of the exploited value is recoverable at the time of reporting.

Official Responses and Available Statements

Cronos’s announcement was limited to confirming that it had identified an exploit in Tectonic and halted the network, with a pledge to share updates as the situation developed. Tectonic’s message to users was similarly narrow: avoid interacting with the protocol while the investigation continues.

Crypto.com CEO Kris Marszalek said the company’s app and exchange were unaffected by the breach and continued operating normally, adding that funds held on those platforms were safe. The statement concerned Crypto.com’s app and exchange, while the incident involved Tectonic on the Cronos chain.

Network Status Remains Unresolved

The network halt left the timing of a return to normal operations unclear. No restart timeline had been announced for Cronos at the time of writing.

Cronos and Tectonic had also not said whether they intend to restrict the attacker’s addresses, attempt to recover the exploited assets, or compensate affected users. The final loss figure remained unconfirmed, and the status of funds still on Cronos was unresolved.

Users with exposure to Tectonic should avoid interacting with the protocol while its investigation continues and monitor updates from Cronos and Tectonic.