Cronos Halts Network After Tectonic Hack, Losses Estimated at $75 Million

The Cronos blockchain halted its network after a hack hit Tectonic, the chain's largest decentralized-finance lending protocol. An on-chain analyst estimated losses at about $75 million.

Cronos said in a post on X on Aug. 30 that it had confirmed an exploit at Tectonic. The network was halted, it said, and further updates would follow. Tectonic separately said it was investigating the incident and urged users not to interact with the protocol until its safety is confirmed.

Neither Tectonic nor Cronos has officially confirmed the exact losses or the cause of the attack. According to DefiLlama, Tectonic had about $121.7 million in total value locked and roughly $82.7 million in outstanding borrows before the incident.

On-chain researcher Weilin Li said the attack appeared to rely on manipulation of Tectonic's governance token, TONIC. The attacker drove up the price of the thinly traded token by about 100-fold in roughly 20 minutes, then used the inflated value as collateral to borrow large amounts of other crypto assets.

Tectonic sets TONIC's collateral factor at 20%. Li said the attack position involved about 364.6 trillion TONIC. To borrow about $75 million, the position would have needed to be valued at roughly $375 million. That implies TONIC's price had to rise about 100-fold from its pre-attack low, broadly matching the pattern Li identified.

The method resembled the oracle price-manipulation attack on Mango Markets in 2022. In that type of exploit, an illiquid asset is pushed sharply higher and then used as overvalued collateral to borrow other assets from a protocol. Tectonic has also warned in its own documentation that low-liquidity assets can be especially vulnerable to price manipulation.

Li initially estimated the attacker had obtained about $66 million. He later raised the total loss estimate to about $75 million after identifying another address believed to be controlled by the attacker that held an additional $8 million. Tectonic and Cronos have not officially confirmed that figure.

The network halt appears to have blocked most of the stolen assets from being moved out. Li said the attacker managed to bridge only about $6 million to Ethereum before Cronos stopped the network, and most of the remaining assets are believed to still be on Cronos.

Crypto.com Chief Executive Officer Kris Marszalek said the Crypto.com app and exchange were not affected by the attack. Crypto.com's security team is also supporting the Cronos investigation. Cronos was originally developed by Crypto.com, while Tectonic operates independently as a DeFi lending protocol on the network.

Cronos has not disclosed when it plans to restart the network or how it will handle the attacker's assets that remain on-chain.