Cronos network halts after $75M Tectonic exploit drains lending protocol

The Cronos blockchain ground to a halt on August 30 after an attacker manipulated the price of Tectonic’s TONIC governance token roughly 100x in about 20 minutes, then borrowed against the inflated collateral to drain an estimated $66M to $75M from the network’s largest independent lending protocol.

Validators moved quickly to freeze the chain, stranding approximately $60M of the stolen value on Cronos itself. Only about $6M was reportedly bridged to Ethereum before the shutdown.

How the exploit worked

Researcher Weilin Li identified the attack as a price-manipulation exploit in the mold of the infamous Mango Markets incident from 2022. The playbook is disturbingly familiar: find a token with thin liquidity, pump its price through aggressive buying, then use the artificially inflated holdings as collateral to borrow real assets from a lending protocol.

Once TONIC’s price was sufficiently inflated, the attacker deposited their holdings into Tectonic as collateral and borrowed against them. The protocol’s oracle, which tracks token prices to determine collateral values, apparently accepted the manipulated price as legitimate. The attacker then drained lending pools of more stable and liquid assets, leaving Tectonic holding a bag of artificially valued TONIC.

The validator halt: feature or bug?

Cronos runs on a Tendermint-based consensus mechanism with a cap of 100 validators. Within minutes of the exploit being identified, validators agreed to halt block production entirely, preventing the attacker from moving the remaining $60M off-chain. It also froze every other transaction, smart contract, and DeFi position on the network.

Crypto.com CEO Kris Marszalek confirmed that the centralized Crypto.com app and exchange were unaffected by the exploit, with user funds safe. CRO token holders on the exchange were insulated, while those interacting with Tectonic directly on Cronos bore the brunt of the damage.

CRO holds steady, but confidence cracks show

The CRO token rose approximately 4-5% following the exploit, likely reflecting the market pricing in the successful containment of the stolen funds.

Tectonic had experienced smaller protocol-logic issues in the past, but nothing at this scale.

The Mango Markets parallel is instructive. In that case, which played out on Solana in October 2022, trader Avraham Eisenberg manipulated MNGO token prices to drain over $100M from the protocol. Eisenberg was later arrested, charged with commodities fraud, and convicted. The legal precedent established that price manipulation of DeFi protocol tokens can carry criminal consequences, even when the exploit technically follows the protocol’s own rules.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.