Cronos Halts Its Chain After an Estimated $75M Tectonic Exploit

Cronos stopped producing blocks on Sunday after an attacker manipulated the price of a small governance token and borrowed against it. The target was Tectonic, the lending protocol holding the largest share of the chain's decentralized finance deposits. On-chain researcher Weilin Li put the take at $66 million to $75 million. Validators halted the network within minutes, which stranded most of the money before it could leave. Neither Tectonic nor Cronos has confirmed a figure.

How the borrowing worked

TONIC is Tectonic's governance token, and it is thin. Blockonomi and CryptoTicker both put its pooled liquidity at about $1.34 million against daily volume near $11,000. That is small enough to move. The attacker pushed TONIC's price up roughly 100-fold inside about 20 minutes, deposited the repriced tokens as collateral, and drew other assets out of the lending pools against them. Tectonic assigned TONIC a 20% collateral factor, meaning a deposit could support borrowing worth a fifth of its stated value. By The Block's count, 364.6 trillion TONIC valued at about $375 million was enough to reach $75 million of loans. COINOTAG carries the same arithmetic. Manipulated collateral is a well-worn route into a lending market, and Moonwell lost about $8.7 million the same way on Base four days earlier.

Li called it "a price-manipulation exploit in the mold of the infamous Mango Markets incident from 2022," in remarks carried by Crypto Briefing.

Two analysts, two sizes

The loss is written two ways. Li's range measures what the attacker realised. CryptoTicker also cites an analyst it names as Awoo, who puts total outflow from the lending pools at $119.5 million, a gross figure covering everything that moved out. Those are different measurements of the same event, no outlet reconciles them, and the higher number appears in one place only. Tectonic's deposits before the attack are written twice as well: $121.7 million by The Block, CryptoTicker and Blockonomi, $121.6 million by BeInCrypto. Outstanding loans stood at $82.7 million, and CryptoTicker puts the protocol at 46% of all Cronos DeFi value.

What the halt bought

Cronos runs on Tendermint consensus with a cap of 100 validators, a design that lets a small set of operators agree to stop. They did. About $6 million had already crossed a bridge to Ethereum by then; roughly $60 million stayed put. The Block identified two attacker-controlled addresses, one holding about $66 million and one about $8 million. Cointelegraph's accounting splits the first the same way, $60 million on Cronos plus $6 million bridged, and keeps the $8 million address separate. The freeze applied to everyone. Every other position, transaction and contract on the chain stopped at the same moment, which is the price of the only tool that worked here.

Who is exposed and who is not

Tectonic operates separately from the exchange and app run by Crypto.com, which built Cronos and issues CRO. Chief executive Kris Marszalek said the app and exchange were not affected and were operating as usual, and that his security team was assisting the investigation. The Block renders his surname Marsalek. Four other outlets render it Marszalek. Traders read the halt as containment: CRO rose on the day, by 3.36% in BeInCrypto's account and closer to 5% in the figures from Crypto Briefing and Blockonomi.

Nothing settled yet

Tectonic told users not to interact with the protocol until it confirms the protocol is safe. That instruction still stands. As of early Monday no outlet reports a resumption of block production, no restart window has been published, and nobody has said whether validators will attempt a rollback or move against the addresses. No party has committed to making depositors whole either. The question a postmortem would have to answer is narrow: how a 20% collateral factor came to sit on a token with $1.34 million of liquidity behind it.