Cronos, the layer-1 blockchain developed by Crypto.com, suspended block production on Sunday, August 30, 2026, after an attacker drained an estimated $75 million from Tectonic, the network’s largest decentralized lending protocol, by inflating the price of the illiquid TONIC governance token roughly 100 times in about 20 minutes and borrowing against the manipulated collateral.
About $6 million of the proceeds reached Ethereum before validators froze the chain, according to the on-chain researcher who first traced the attack.
In a post on X on August 30, 2026, Cronos Network said, “We identified an exploit in Tectonic. The Cronos Network has been halted and we’ll provide updates here.” Tectonic (@TectonicFi) confirmed the incident in a separate post the same day, telling users, “As a precaution, please do not interact with the protocol until we confirm it is safe to do so.”
On-chain researcher Weilin Li said in an X thread that the attacker manipulated the market price of TONIC before depositing the inflated position as collateral and borrowing other assets from Tectonic’s pools. He characterised the method as a “Mango-market style” pump-and-borrow attack, a reference to the $100 million Mango Markets exploit of October 2022.
How the Attack Worked
DeFiLlama recorded Tectonic holding approximately $121.7 million in total value locked (TVL) and about $82.7 million in outstanding loans immediately before the incident. Tectonic accounted for roughly 46% of all DeFi capital on Cronos, with the next largest lender on the chain holding only about $30,000.
Tectonic’s own published parameters give TONIC a 20% collateral factor. TONIC itself had trading liquidity of roughly $1.34 million and daily volume of about $11,000 ahead of the attack, per market data on CoinGecko, thin enough that a comparatively small amount of capital could move the price sharply.
Li said the attacker pumped TONIC roughly 100 times in about 20 minutes, about 84% at the time of writing. Based on the roughly 364.6 trillion TONIC tokens he identified in the attack position, the tokens would have needed to be valued at about $375 million, or roughly $0.00000103 each, to support the estimated $75 million in borrowing the attacker took out. That price is around 100 times TONIC’s pre-attack low on CoinGecko, matching Li’s timeline.
Tectonic’s own documentation warns that low-liquidity assets can be particularly susceptible to price manipulation.
Fund Movement and Attacker Addresses
Li initially put the drain at about $66 million, then revised his estimate to roughly $75 million after identifying a second attacker-controlled address holding about $8 million on Cronos. Of the total, only about $6 million reached Ethereum before validators halted the chain, leaving the balance frozen on Cronos.
In an August 30 alert on X, blockchain security firm PeckShield put the aggregate loss at about $74 million and broke down the attacker’s holdings across three addresses: approximately $60 million on Cronos at 0x7d4e…4f2dc, roughly $6 million bridged to Ethereum at 0xc404…72dd, and about $8 million on Cronos at 0x215a…d3fc.
On-chain analytics firm Lookonchain, in its own post on August 30, said the attacker had already bridged $6.29 million to Ethereum and swapped it for 2,592 ETH, with about $68.7 million remaining on Cronos at the time of writing.
Cronos runs on a Tendermint-based consensus mechanism with a cap of 100 validators. That comparatively small validator set allowed the network’s operators to coordinate a halt within minutes, an option that is not practical on chains with tens of thousands of independent validators.
Crypto.com’s Response
Crypto.com Chief Executive Kris Marszalek posted on X on August 30, 2026, that “There has been a security breach on a Cronos lending protocol, Tectonic. Cronos team is investigating, with assistance from the Crypto.com security team. Crypto.com app and exchange were not affected and are operating as usual. All funds are safe.” He said a full post-mortem would follow once the investigation was complete.
Crypto.com developed the Cronos network, while Tectonic operates as an independent DeFi lending protocol on it. Tectonic launched in December 2021 out of the Cronos Labs incubator and runs separately from the exchange group.
Precedent and Wider Context
A parallel on-chain analysis carried out through a Cronos archive node, flagged by Foresight News, put the amount drained from Tectonic’s lending pools at roughly $119.5 million over a window of about 65 minutes, materially higher than Li’s headline figure.
According to that account, only about $1.73 million remained across the affected markets after the attack, with 752 liquidations seizing an additional $8.71 million from other users and roughly $32.6 million left behind as bad debt.
The same analysis walked through the mechanics step by step. The attacker first deposited 3,091 TONIC and borrowed 3,697 TONIC in the same block. About 14 seconds later, the TONIC oracle price jumped 6.46 times inside a single block, sharply increasing the value of the attacker’s collateral and unlocking roughly $125.6 million in borrowing capacity.
The attacker then withdrew approximately $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH and 39.61 million CRO, alongside several smaller tokens. Li’s $75 million figure describes proceeds held in attacker-controlled addresses after the halt; the $119.5 million describes total outflows from the pools before liquidations and bad debt are netted out, which accounts for most of the gap.
The Tectonic incident is the third recent oracle-linked price manipulation attack Li has publicly flagged. He pointed to the Moonwell exploit on Base three days earlier, which lost an estimated $8.7 million to manipulation of the illiquid MAMO token, and to a $9.5 million exploit of the stablecoin protocol Resupply in 2025. All share a template of inflating an illiquid asset’s price and using the manipulated valuation as collateral to draw down other assets.
Recent weeks have already been costly for the sector. Multiple exploits, including Term Finance’s $8.5 million governance breach on August 23, 2026, have pushed 2026 losses past $1.26 billion across more than 219 incidents, according to figures tracked by The Crypto Times.
The incident also lands at a sensitive moment for the CRO ecosystem. On August 7, 2026, Trump Media, Crypto.com and Yorkville Acquisition Corp mutually terminated their previously announced $6.42 billion CRO treasury vehicle, which had been billed at launch on August 26, 2025 as one of the largest publicly traded digital-asset treasury projects.
Restart and Recovery
Neither Cronos nor Tectonic had announced a restart timeline or a plan for the funds sitting in the attacker’s addresses at the time of writing. The options available to validators include restarting the network without further action, freezing the attacker-controlled addresses, or attempting to roll the chain back to a pre-exploit state.
Each option carries the trade-off that a chain which can switch itself off is also one that can be pushed to reverse transactions, a debate that periodically resurfaces across the industry.
There is precedent for the recovery route. In October 2022, BNB Chain paused block production within about five hours of a bridge exploit that had minted roughly $570 million of tokens, with 26 validators eventually recovering close to $470 million.
Tectonic depositors have not been offered any confirmed backstop. Every open position on the protocol, including deposits accruing interest and loans secured against collateral, is frozen at its pre-halt state until validators restart the chain.
CRO, the base asset of the Cronos chain, was trading around $0.06 at press time, per Crypto.com’s own price page. The token remains well below its September 2025 range near $0.20, reached in the initial reaction to the Trump Media treasury announcement, and far off its all-time high of about $0.89 set in November 2021.
Li’s $75 million estimate has not been independently confirmed by Tectonic or Cronos. Tectonic said it would post a verified update once the investigation allows.
Also Read: Full Sail Confirms Sui Vault Losses as Switchboard Halts 4 Chains
