Cronos halted block production on Aug. 30 after detecting an exploit involving Tectonic, a decentralized lending protocol operating on the blockchain, with researchers estimating roughly $75 million in losses.
Attacker Inflated TONIC Collateral
Independent researcher Weilin Li attributed the incident to the treatment of TONIC, Tectonic's governance token, as collateral. TONIC reportedly had a 20% collateral factor despite limited market liquidity. The attacker increased TONIC's market price roughly 100-fold over about 20 minutes, then supplied the inflated tokens as collateral and borrowed other assets from Tectonic.
Most Funds Remain on Cronos After Halt
Li initially placed the affected assets at approximately $66 million. Around $6 million crossed to Ethereum before Cronos validators halted block production, while roughly $60 million remained at a Cronos address. The researcher later identified another address holding approximately $8 million, raising his combined estimate to around $75 million. The fact that assets remain on Cronos does not mean they have been recovered — a network restart could allow the attacker to resume moving funds.
Crypto.com Exchange Unaffected
Crypto.com CEO Kris Marszalek said the company's app and centralized exchange continued operating normally. "All funds are safe," he wrote, referring to assets held through Crypto.com services. That statement does not cover funds deposited directly into Tectonic. Crypto.com and Cronos are closely associated, but Tectonic operates as a separate decentralized lending application on the network.
Restart Depends on Containment
Cronos must determine whether the identified addresses can move funds safely before restoring block production. A technical review must establish how Tectonic valued TONIC collateral and whether its price source included sufficient protections against manipulation. The incident resembles the Mango Markets manipulation, where inflated governance-token collateral supported loans against more liquid assets. Cronos and Tectonic have not announced a restart timetable, recovery plan or user compensation framework.
