The Cronos blockchain, the network linked to Crypto.com, halted operations on Sunday after an attacker manipulated the price of Tectonic's TONIC token and borrowed against it, draining the network's largest lending protocol. Onchain researcher Weilin Li put the loss at roughly $75 million, while a separate onchain analysis cited by Coinpedia estimated $119.5 million, and Crypto.com CEO Kris Marszalek said the exchange itself was unaffected.
Cronos ground to a halt on Sunday after validators froze block production within minutes of spotting the exploit, a move only possible because of the network's small validator set. It trapped most of the stolen funds on-chain while Tectonic and Cronos worked to establish what had happened.
TONIC price manipulation drains Tectonic
The attacker pushed TONIC, Tectonic's thinly traded governance token, to about 100 times its price within 20 minutes, then deposited the inflated holdings as collateral to borrow other assets from the protocol. Onchain researcher Weilin Li initially estimated the attacker received about $66 million before identifying a second attacker-controlled address holding roughly $8 million, bringing his estimate to approximately $75 million. Li compared the mechanism to the 2022 Mango Markets exploit, in which an attacker manipulated a token's price to borrow against it.
Tectonic's own documentation warns that low-liquidity assets are particularly susceptible to this kind of manipulation. The protocol had approximately $121.7 million in total value locked and about $82.7 million in active loans before the incident, per DefiLlama data, and has not confirmed the amount affected or the exact cause.
A separate onchain analysis, cited by Coinpedia, described a different sequence: the attacker deposited 3,091 TONIC and borrowed 3,697 TONIC in the same block, and 14 seconds later the TONIC oracle price jumped 6.46 times in a single block, enabling about $125.6 million in borrowing. That analysis put the total drained at approximately $119.5 million, including $54.32 million in USDC and $44.87 million in USDT withdrawn from the protocol. Neither figure has been confirmed by Tectonic.
Validators halt the chain, trapping most of the funds
Cronos runs on a Tendermint-based consensus with a cap of 100 validators, and they agreed to halt block production within minutes of the exploit being identified, freezing every transaction and smart contract on the network. Weilin Li said the attacker was only able to bridge around $6 million to Ethereum before Cronos halted, preventing most of the affected assets from leaving the chain. Cronos said in a post on X: "We identified an exploit in Tectonic", adding it would provide updates as the investigation continues.
The CRO token rose approximately 4-5% following the exploit, which the report said likely reflected the market pricing in the containment of the stolen funds. Crypto.com CEO Kris Marszalek said the firm's app and exchange were not compromised and that its security team is assisting Cronos with the investigation. Tectonic operates as an independent DeFi lending protocol on Cronos and was the network's first such platform.
The incident follows a similar attack three days earlier on Base-network lender Moonwell, which lost an estimated $8.7 million to a similar token-price manipulation. It also echoes last year's $9.5 million exploit of stablecoin protocol Resupply. Cronos has not disclosed a timeline for restarting the network or said what will happen to the attacker's assets once it resumes.
Sources: The Block, Crypto Briefing, Coinpedia Fintech News
Trading involves risk.
Risk Disclaimer
