TLDR
- An attacker manipulated the price of the TONIC token 100-fold in 20 minutes to exploit Tectonic, Cronos’s largest lending platform
- The attacker used inflated TONIC as collateral to borrow real assets, with losses estimated at around $75 million
- Cronos halted its entire blockchain to stop the attack, a move possible due to its small validator set of 100
- Tectonic’s total value locked dropped from $121.7 million to roughly $3 million
- Crypto.com’s CEO confirmed its app and exchange were unaffected and operating normally
Cronos, the blockchain launched by Crypto.com in 2021, halted its network on Sunday after an attacker exploited Tectonic, its biggest decentralized lending platform. The estimated loss is around $75 million.
⚠️ALERT: A hacker just drained an estimated $75 MILLION from a Cronos lending protocol, forcing the entire blockchain to HALT mid-attack.
The attacker reportedly pumped Tectonic’s thinly traded TONIC token 100x in just 20 minutes, then used the inflated collateral to borrow… pic.twitter.com/W40XgMmH9Q
— Coin Bureau (@coinbureau) August 31, 2026
Tectonic allows users to deposit crypto and borrow other assets against it, similar to using a house as collateral for a loan. One of the assets it accepted as collateral was TONIC, its own governance token.
TONIC had just $1.34 million in liquidity and about $11,000 in daily trading volume. Tectonic’s own documentation had warned that low-liquidity assets are vulnerable to price manipulation.
The attacker pushed TONIC’s price up roughly 100-fold in about 20 minutes. They then deposited those inflated tokens into Tectonic and borrowed real assets against them, using TONIC’s 20% collateral factor.
Researcher Weilin Li described it as a “Mango-market style” pump-and-borrow attack. He estimated the attacker bridged about $6 million to Ethereum before the network was paused, leaving around $60 million on Cronos. A second attacker-controlled address added another $8 million to the estimated total.
Cronos Shuts Down the Network
Cronos validators paused the blockchain to stop further damage. The chain runs on just 100 validators, which is few enough to coordinate a shutdown within minutes.
BNB Chain used the same approach in October 2022 after a bridge exploit, recovering close to $470 million of the $570 million taken. However, halting a chain also stops all other users from moving their funds.
Tectonic had around $121.7 million in assets locked in the protocol on August 26. By Monday, that figure had dropped to roughly $3 million.
Crypto.com CEO Kris Marszalek confirmed the company’s app and exchange were unaffected and that user funds there were safe.
No Timeline Given Yet
Neither Cronos nor Tectonic had published a restart timetable or confirmed the full extent of losses as of Monday morning.
Tectonic’s last public posts before the attack were from June and May, when it warned users to withdraw one asset and reduced borrowing limits on others.
This attack follows a similar exploit on lending platform Moonwell last week, where an attacker also manipulated a thinly traded collateral token. A separate incident on Pendle triggered around $36 million in liquidations on Morpho.
Cronos and Tectonic have not said whether they plan to restrict the attacker’s addresses, recover the stolen assets, or compensate users affected by the exploit.
