Cronos Halts Its Own Blockchain After a $75M Tectonic Exploit

MakeCryippreferred on

• Cronos halted block production on Sunday after identifying an exploit in Tectonic, its largest lending protocol.
• Independent researcher Weilin Li put the total affected near $75 million, though Cronos and Tectonic have not confirmed a figure.

Cronos stopped producing blocks on Sunday after confirming an exploit had hit Tectonic, the lending protocol that carried the largest share of activity on its chain. “We identified an exploit in Tectonic,” Cronos said on X. “The Cronos Network has been halted and we’ll provide updates here.”

Tectonic followed with its own warning. “As a precaution, please do not interact with the protocol until we confirm it is safe to do so,” the project said, adding that it was investigating.

How the Attack Worked

Independent researcher Weilin Li, who tracked the exploit on-chain, said the attacker manipulated the price of TONIC, Tectonic’s governance token, pushing it roughly 100-fold higher in about 20 minutes. Tectonic applied a 20% collateral factor to TONIC, so the inflated price let the attacker borrow other, harder assets against a token that was never worth what the market briefly showed.

Li initially estimated the attacker had captured about $66 million before identifying a second attacker-controlled address holding roughly $8 million more, raising his total estimate to approximately $75 million. About $6 million reached Ethereum before the halt; Li’s tracking shows most of the rest stayed on Cronos.

The mechanics resemble other crypto security incidents, including the 2022 Mango Markets exploit and the SAND token hack, in which attackers have exploited weaknesses around token pricing, liquidity or protocol security.

Why Cronos Could Halt the Chain

Cronos runs on Tendermint consensus with an active validator set capped at 100, a structure that makes a coordinated emergency pause operationally realistic in a way it isn’t on most larger, more decentralized chains. That is what let Cronos trap most of the exploit-linked funds before they left the network, similar to how BNB Chain validators paused that chain within hours of a $570 million bridge exploit in October 2022 and recovered close to $470 million.

The same lever cuts both ways. Stopping block production also froze every other open position, pending transaction, and smart-contract call on Cronos, not just the attacker’s, for as long as the halt lasts.

Who’s Exposed, and What’s Still Unconfirmed

Crypto.com CEO Kris Marszalek said on X that the exchange’s app and centralized products were unaffected, that customer funds there remained safe, and that the company’s security team was assisting Cronos’s investigation. He said a full postmortem would follow.

Tectonic held about $121.7 million in total value locked and roughly $82.7 million in active loans immediately before the exploit, according to DefiLlama.

Neither Cronos nor Tectonic had released an official cause, a final loss figure, a restart timeline, or a compensation framework as of Monday. Tectonic’s own documentation has previously warned that low-liquidity assets are especially vulnerable to this kind of price manipulation, a risk also seen in incidents such as the Fogo crypto hack, a caveat the protocol’s own collateral rules did not appear to price in for TONIC.