Cronos Halts Blockchain After $75M Tectonic Exploit as DeFi Lending Protocol Gets Hit

Cronos has halted its entire blockchain after an exploit targeting decentralized lending protocol Tectonic put an estimated $75 million of crypto at risk, forcing validators to freeze block production while investigators trace the attacker’s movements.

The incident is one of the largest DeFi exploits on Cronos and has effectively brought the network to a standstill. While around $6 million reportedly reached Ethereum before the halt, most of the suspected proceeds remain on Cronos.

Crypto.com CEO Kris Marszalek said the company’s exchange and app were unaffected and that customer funds remained safe.

Cronos Freezes Network After Tectonic Exploit

Cronos halted the network on Sunday after identifying an exploit affecting Tectonic, the largest decentralized lending protocol on the blockchain.

Tectonic allows users to deposit crypto into lending pools and earn interest while other users borrow against collateral. Before the attack, the protocol held more than $120 million in deposits and over $80 million in active loans.

The shutdown stopped all activity on Cronos, including transactions unrelated to Tectonic.

Cronos said it was investigating the incident with security teams across the industry and had not provided a timeline for restarting the network.

Tectonic has also warned users not to interact with the protocol until the investigation is complete.

How the $75M Tectonic Attack Allegedly Worked

Onchain researcher Weilin Li described the incident as a “Mango-market style” price manipulation attack, referring to the $100 million Mango Markets exploit in 2022.

The suspected attack centered on TONIC, Tectonic’s governance token.

According to Li, Tectonic assigned TONIC a 20% collateral factor despite the token having extremely limited liquidity. That meant an attacker could potentially manipulate TONIC’s market price, use the inflated valuation as collateral and borrow significantly more valuable assets from the protocol.

TONIC reportedly surged roughly 100-fold within 20 minutes during the attack.

Its liquidity was only around $1.34 million, making the token particularly vulnerable to large price movements.

The attacker allegedly exploited that mismatch between TONIC's market price and its actual available liquidity.

Li initially estimated that around $66 million was affected. He later identified another attacker-controlled wallet holding approximately $8 million, pushing his estimate of the total loss toward $75 million.

Security firm PeckShield independently estimated the incident at roughly $74 million.

Most of the Funds Remain Trapped on Cronos

The decision to halt Cronos appears to have limited the amount of funds that could leave the network.

Li estimated that approximately $6 million in assets had been bridged to Ethereum before validators stopped block production.

That left roughly $60 million or more on Cronos, where the funds became effectively immobilized after the network shutdown.

Some of the suspected proceeds were reportedly moved into decentralized exchange liquidity pools before the halt.

The network's ability to stop activity quickly is partly linked to its relatively small validator set. Cronos uses a capped set of 100 validators, allowing operators to coordinate a response more quickly than would be possible on some larger decentralized networks.

But the same mechanism creates a significant trade-off.

When the blockchain stops, every user is affected, not just those connected to the exploited protocol.

Open loans, trades, automated transactions and other DeFi operations can all be interrupted.

Tectonic Was Cronos' Largest DeFi Protocol

The scale of the incident is particularly significant because Tectonic represented a substantial portion of Cronos' DeFi ecosystem.

Before the exploit, Tectonic had approximately $121.7 million in deposits and $82.7 million in active loans, according to DeFiLlama data cited in the reports.

That made it the dominant lending platform on Cronos.

By comparison, the next-largest lending protocol on the network held only around $30,000 in deposits, highlighting just how concentrated Cronos' DeFi activity had become around Tectonic.

Following the exploit, Tectonic's deposits collapsed to roughly $3 million.

The sharp decline illustrates how quickly confidence can disappear from a DeFi protocol once users suspect that collateral pricing or smart-contract logic has been compromised.

Crypto.com Says Its Users Are Safe

The Cronos incident has also raised questions about whether Crypto.com customers and the company's centralized services were affected.

Crypto.com CEO Kris Marszalek said the company's app and exchange continued operating normally.

He also said customer funds were safe and promised a postmortem.

The distinction matters because Cronos and Crypto.com's centralized exchange are connected through the broader ecosystem but are not the same infrastructure.

The current incident involves Tectonic and the Cronos blockchain rather than a reported compromise of Crypto.com's centralized exchange.

A Growing Pattern of DeFi Price Manipulation

The Tectonic exploit also highlights a recurring weakness across DeFi markets: using thinly traded tokens as collateral.

An asset can have a seemingly large market capitalization while still having insufficient liquidity to support that valuation during a major trade.

If a lending protocol accepts that market price at face value, an attacker can potentially manipulate the token's price, borrow against the inflated valuation and leave the protocol with bad debt.

Similar attacks have recently targeted other DeFi markets.

That makes the incident relevant beyond Cronos. Protocols increasingly need to account for liquidity depth, oracle design and the difference between a token's displayed market price and the amount of capital that can actually be extracted from the market.

A similar pattern was visible in the recent Avici exploit, where an apparent gap between the platform's stated security assumptions and the privileged functionality embedded in its smart contracts became central to the attack.

Related: Solana Neobank Avici Loses $650K in Hack as AVICI Token Crashes 27%

Cronos Has Not Said When the Network Will Restart

The biggest unanswered question is when Cronos will resume block production.

Neither Cronos nor Tectonic has provided a definitive restart timeline or confirmed the final amount stolen.

They also have not said whether the attacker-controlled addresses will be frozen, whether the funds can be recovered or whether affected Tectonic users will ultimately be compensated.

Tectonic has advised users to stay away from the protocol until further notice.

For now, the shutdown remains a containment measure rather than a resolution.

What Happens Next

The investigation will need to establish the exact attack path, determine the final loss and assess whether any remaining funds can be recovered.

Cronos will also need to determine whether restarting the chain requires changes to its infrastructure or coordination with Tectonic and other ecosystem participants.

The incident could have wider consequences for how lending protocols evaluate governance tokens as collateral.

If a token with limited liquidity can be used to borrow tens of millions of dollars simply because its quoted price is temporarily inflated, protocols may face pressure to introduce stricter collateral parameters and more robust price-oracle safeguards.

For Cronos, however, the immediate priority is simpler: secure the network, trace the missing funds and restore normal operations without allowing the attacker to exploit the same weakness again.

Until that happens, the $75 million Tectonic exploit remains one of the most serious security incidents the Cronos ecosystem has faced.