Cronos stopped producing blocks Sunday. An attacker had exploited Tectonic, the chain’s biggest lending protocol, and the network pulled the plug. Onchain researcher Weilin Li puts the damage at roughly $75 million in affected assets. Tectonic has not confirmed that number.
Cronos is the chain tied to exchange Crypto.com. Tectonic sits on top of it as an independent DeFi lending protocol. Before the attack it held about $121.7 million in total value locked and $82.7 million in active loans, per DefiLlama.
The chain’s own X account said it had “identified an exploit in Tectonic” and halted. Tectonic told users not to interact with the protocol until it confirms it is safe. No restart timeline from either side. Crypto.com chief executive Kris Marszalek said the exchange’s app and trading platform were not compromised and that Crypto.com’s security team is assisting Cronos with the investigation.
Li pins the exploit on manipulation of TONIC, Tectonic’s thinly traded governance token. The price climbed roughly a hundredfold in about 20 minutes, his analysis shows. The attacker then posted the pumped TONIC as collateral and drained the lending pool against it. That shape, pump a low-liquidity token and borrow against the spike, mirrors the 2022 Mango Markets oracle attack on Solana. Li and others have cited Mango as a template for this class of exploit more than once.
Tectonic’s own documentation warns that low-liquidity assets are susceptible to price manipulation. TONIC carries a 20% collateral factor in the protocol’s money-market parameters. Borrowers can draw loans equal to one-fifth of posted TONIC value. Li found an attack position holding 364.6 trillion TONIC. To support $75 million in borrowing at that factor, those tokens would need to be valued near $375 million, or about $0.00000103 each. Roughly a hundred times the pre-attack CoinGecko price.
Li initially pegged the loss at about $66 million. A second attacker-controlled address then surfaced holding roughly $8 million, pushing the total near $75 million. Only around $6 million is believed to have crossed a bridge to Ethereum before Cronos halted, Li said. The remaining assets sit in limbo. Nobody has said what happens to them once the chain resumes.
The attack is part of a pattern. Three days earlier, Moonwell on Base lost about $8.7 million after someone manipulated its MAMO token price and borrowed against inflated collateral. Li also flagged a 2025 Resupply incident that cost $9.5 million and followed the same playbook. Traders, as ever, disagree on whether these are copycats or the same neglected parameter setting getting found by different hands.
The unknowns stack up. Full root cause. Independently confirmed loss figure. A restart plan from Cronos. Tectonic has not backed Li’s $75 million estimate or named a specific attack vector. Cronos has not said whether it will coordinate a state rollback, freeze bridged funds, or take no recovery action at all. Marszalek’s post is the only statement from the Crypto.com side beyond the chain’s own announcement. Tectonic’s last public instruction was to stand clear of the protocol.
