Pendle

DeFi

Cronos

Mango

Tectonic

On Sunday, Cronos halted its whole blockchain after an attacker drained ~$75 million from Tectonic, the network’s largest lending market.
The halt trapped all but about $6 million of the loot before it could leave the chain.
<h3 id="span-style-font-weight-400-only-6-million-reached-ethereum-before-cronos-stopped-producing-blocks-span">Only $6 million reached Ethereum before Cronos stopped producing blocks</h3>
The attack targeted the price of TONIC, the protocol’s thinly traded governance token, said on-chain researcher Weilin Li, who was the first to lay the sequence out on X.
The token was pumped about 100 times in 20 minutes and then collateralized to borrow other real assets out of the protocol, Li <a href="https://x.com/hklst4r/status/2094079327176466563?s=20" rel="noopener noreferrer nofollow">says</a>.
Tectonic’s own parameters gave TONIC a 20% collateral factor, meaning a depositor could borrow up to a fifth of the value of the deposited token. Li counted about 364.6 trillion TONIC in the attack position.
The pile needed to be worth around $0.00000103 per token to support the borrowing on display, CoinGecko data shows, or about 100 times where TONIC was trading before the attack.
Tectonic’s documentation warned that low-liquidity assets are susceptible to exactly this kind of price manipulation.
Li compares it to the 2022 Mango Markets hack, where a trader inflated an illiquid token and borrowed against the fake value.
“We identified an exploit in Tectonic. The Cronos Network has been halted and we’ll provide updates here,” Cronos Network posted on X on August 30.
<figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/08/2026-08-31-cronos-tectonic-tonic-exploit-01.png" alt="A 100-fold TONIC pump in 20 minutes cost Tectonic $75 million." width="579" height="183">
 <figcaption>
 Source: <a href="https://x.com/CronosNetwork/status/2094072333434769703" rel="noopener noreferrer nofollow">Cronos Network</a> via X.
 </figcaption>
</figure>
Tectonic also warned users to stay away from the protocol until it could confirm the situation was safe.
Li began with a total of about $66 million, then raised it to about $75 million when he followed the track to a second address belonging to an attacker with another $8 million.
Only about $6 million was sent to Ethereum before Cronos stopped making blocks. This meant that most of the stolen assets stayed on the chain they were stolen from.
According to <a href="https://defillama.com/protocol/tectonic" rel="noopener noreferrer nofollow">DeFiLlama</a>, Tectonic had about $82.7 million in active loans and about $121.7 million in locked value before the attack.
The figures reported by Li are not confirmed by <a href="https://x.com/TectonicFi/status/2094072821630799989?s=20" rel="noopener noreferrer nofollow">Tectonic</a> or Cronos.
<h3 id="span-style-font-weight-400-lending-protocols-logged-67-exploits-out-of-267-defi-incidents-span">Lending protocols logged 67 exploits out of 267 DeFi incidents</h3>
Chief executive Kris Marszalek said in a post on X that the Crypto.com app and exchange were not compromised and that the firm’s security team is helping Cronos investigate.
The exposure is with the Tectonic DeFi app, not the Crypto.com exchange. Tectonic is the first lending protocol in the network and runs independently on Cronos.
CRO fell about 10.0% over 24 hours as the news spread, and it’s changing hands at ~$0.055 according to CoinGecko.
Li said an attacker manipulated the price of the illiquid MAMO token, causing <a href="https://www.cryptopolitan.com/moonwell-price-manipulation-exploit/" rel="noopener noreferrer nofollow">Base lending protocol Moonwell</a> to lose an estimated $8.7 million three days earlier.
He also highlighted an August 25 episode where a thinly traded Pendle market was gamed into about $36 million of liquidations on leveraged PT-reUSD positions on Morpho.
Cryptopolitan reported in July an oracle attack on <a href="https://www.cryptopolitan.com/balance-coin-crashes-after-oracle-attack/" rel="noopener noreferrer nofollow">Balance</a> Protocol that fed a bad price, which crashed the BLC token about 99% and drained about $912,000 from governance entity 42DAO.
In February, lending protocols <a href="https://www.cryptopolitan.com/lending-protocols-are-becoming-the-target-of-defi-exploits/" rel="noopener noreferrer nofollow">logged</a> 67 exploits over the past year out of 267 DeFi incidents. Price manipulation alone accounted for 13 attacks and resulted in about $65 million in losses.
Cronos hasn’t said when it will reboot the chain or what it will do with the attacker’s stranded assets.
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

An attacker inflated TONIC 100 times to pull $75 million out of Tectonic

Table of Contents

Cryptopolitan_News

Other articles published on Aug 31, 2026

Join our free newsletter for daily crypto updates!