The Cronos blockchain suspended operations on Sunday after an exploit targeted Tectonic, the network’s primary decentralized lending application. Independent on-chain researcher Weilin Li estimated that approximately $75 million in assets were affected, though neither Cronos nor Tectonic had publicly confirmed the precise figure or root cause as of Monday.

Cronos Network stated that it had identified an exploit involving Tectonic and stopped block production while investigations continued. Tectonic separately instructed users to refrain from interacting with the protocol pending further review. No timetable for restarting the chain or details on recovery measures had been released.

How the Attack Unfolded

According to Li’s analysis, the incident centered on TONIC, Tectonic’s governance token. Despite limited market liquidity, the token carried a 20 percent collateral factor within the protocol. The attacker allegedly drove TONIC’s price roughly 100-fold higher over about 20 minutes, then deposited the inflated tokens as collateral to borrow other assets from Tectonic.

Li described the approach as a pump-and-borrow strategy comparable to the 2022 Mango Markets incident. Initial estimates placed the affected amount near $66 million. After identifying an additional attacker-linked address holding about $8 million, Li revised the total to approximately $75 million.

On-chain tracking indicated that only about $6 million to $6.29 million reached Ethereum before the halt, where it was reportedly exchanged for roughly 2,592 ETH. The bulk of the remaining funds stayed on Cronos addresses.

Impact on Protocol and Ecosystem

Tectonic’s total value locked fell sharply. Data from DefiLlama showed the protocol held around $121 million shortly before the incident. By Monday the figure had declined to roughly $3 million. The protocol had accounted for a substantial share of DeFi activity on Cronos prior to the exploit.

Crypto.com Chief Executive Kris Marszalek confirmed that the company’s centralized application and exchange continued normal operations. He stated that funds held through those services remained safe and that the firm’s security team was assisting the investigation. Tectonic functions as a separate decentralized application on the Cronos network.

Containment and Outstanding Questions

Most of the identified assets remained on Cronos after validators stopped the network. Security firm PeckShield estimated losses near $74 million and listed three addresses associated with the attacker: roughly $60 million and $8 million on Cronos, plus about $6 million on Ethereum.

Neither Cronos nor Tectonic had indicated whether identified addresses would be restricted, whether transactions might be reversed, or whether affected users would receive any form of reimbursement. Restarting the chain without additional safeguards could allow remaining funds to move, while any intervention would raise questions about network governance and finality.

Similar price-manipulation attacks on thinly traded collateral have affected other lending protocols in recent weeks, including an incident on Moonwell that resulted in more than $8 million in losses. Tectonic’s documentation had previously noted the risks associated with low-liquidity assets used as collateral.

As of the latest available information, investigators continued reviewing the valuation mechanisms for TONIC collateral and the full extent of any bad debt within the protocol. Further official updates were expected to address the network restart, final loss accounting, and next steps for depositors.