Cronos Blockchain Halted Following $75 Million Tectonic DeFi Exploit

Cronos switched off its entire blockchain on Sunday to contain an attack on DeFi lending protocol Tectonic, freezing every position on the network in the process.

Tectonic enables users to deposit crypto for others to borrow against posted collateral, earning interest in return. It was the first such protocol to launch on Cronos and remains by far the largest, holding close to half of all the capital deposited across the network's DeFi apps. The next-biggest lender on the chain, Mimas Finance, holds about $30,000, according to DefiLlama.

In a tweet, Cronos noted that it had "identified an exploit" in Tectonic, adding that it had halted the Cronos Network and would provide updates. A day later it confirmed the chain was still down, saying it was investigating "with support from security teams across the industry."

Onchain researcher Weilin Li described it as a "Mango-market style pump-and-borrow price manipulation attack," a reference to the $100 million exploit of Mango Markets in October 2022. TONIC's price surged 100-fold within 20 minutes, he said, before the attacker borrowed against it.

The root cause, in Li's account, was simple: Tectonic assigned its own governance token a 20% collateral factor despite very thin liquidity, letting the attacker draw a fifth of a valuation the market could never have supported. TONIC's liquidity stands at about $1.34 million, small enough that modest sums move the price sharply. He put the haul at $66 million, then revised it to around $75 million after identifying a further attacker-controlled address holding $8 million. Security firm PeckShield reached a similar figure of about $74 million.

Tectonic held about $121.7 million in deposits and $82.7 million in active loans shortly before the incident, according to DefiLlama, close to half of all capital in Cronos DeFi. By Monday that had collapsed to roughly $3 million, a fall of 97.5% over 30 days. A separate onchain analysis puts the total moved out of the pools far higher, at about $119.5 million, measuring gross outflow instead of attacker proceeds.

Why the chain went dark

The halt worked, at least in containment terms. Only about $6 million of the proceeds reached Ethereum before block production stopped, Li said, leaving roughly $60 million immobilised on a chain that has not moved since.

Part of it was parked in a decentralized exchange pool, which he suggested was an attempt to avoid blacklisting. DefiLlama data is consistent with that: the largest decentralized exchange on Cronos gained close to $61 million in deposits over the same 24 hours, while DeFi holdings across the chain as a whole fell 22%.

It was possible because Cronos runs a capped validator set of 100, small enough to coordinate a shutdown quickly. The trade-off is that everything else stopped too: open loans, trades, payouts and automated positions belonging to users who never touched Tectonic.

Crypto.com CEO Kris Marszalek said the exchange and app were operating normally and that customer funds were safe, promising a postmortem. Tectonic told depositors not to interact with the protocol until it confirmed doing so was safe.

Li called it the third Mango-style attack in recent weeks, following one on Moonwell, where manipulation of the illiquid MAMO token cost an estimated $8.7 million, and another on a Pendle reUSD market that triggered roughly $36 million in liquidations on August 25.

It is not Tectonic's first breach. DefiLlama records two earlier incidents on the protocol, both classified as protocol logic failures: one in February 2024 that cost $250,000, and another in November 2024. It classifies Sunday's attack differently, as oracle manipulation carried out through spot price manipulation, and puts the loss at $75 million.

Neither Cronos nor Tectonic has given a restart timeline, confirmed a final figure, or said whether depositors will be made whole.