Cronos, the blockchain run by Crypto.com, shut down its entire blockchain on Sunday to contain an attack on the DeFi lending protocol Tectonic, freezing all positions on the network during the process.
Tectonic allows users to deposit cryptocurrencies so that others can borrow against the collateral provided, earning interest in return. It was the first protocol of its kind to launch on Cronos and remains by far the largest, holding nearly half of all capital deposited in the network's DeFi applications. The second-largest lender on the network, Mimas Finance, holds about $30,000, according to DefiLlama.
In a tweet, Cronos said it had "identified an exploit" in Tectonic, adding that it had halted the Cronos Network and would provide updates. A day later, it confirmed the network was still down, saying it was investigating "with the support of security teams from across the industry".
On-chain researcher Weilin Li described it as a "Mango-market-style pump-and-borrow price manipulation attack", a reference to the $100 million Mango Markets exploit of October 2022. The price of TONIC surged 100-fold in 20 minutes, he said, before the attacker borrowed against it.
The root cause, in Li's account, was simple: Tectonic assigned its own governance token a 20% collateral factor despite very low liquidity, allowing the attacker to withdraw a fifth of a valuation the market could never have supported.
TONIC's liquidity stands at around $1.34 million, small enough that modest sums move the price sharply. He initially estimated the amount at $66 million, then revised it to about $75 million after identifying an additional address controlled by the attacker holding $8 million. Security firm PeckShield arrived at a similar figure, around $74 million.
Tectonic held about $121.7 million in deposits and $82.7 million in active loans shortly before the incident, according to DefiLlama, nearly half of all DeFi capital on Cronos. By Monday, that figure had fallen to roughly $3 million, a drop of 97.5% in 30 days. A separate on-chain analysis puts the total moved out of the pools much higher, at around $119.5 million, measuring gross flow rather than the attacker's profit.
Why the network went down
The halt worked, at least in terms of containment. Only about $6 million of the proceeds reached Ethereum before block production stopped, Li said, leaving roughly $60 million stranded on a network that has not moved since.
Part of the amount was parked in a decentralised exchange pool, which he suggested was an attempt to avoid blacklisting. DefiLlama's data is consistent with this: the largest decentralised exchange on Cronos gained about $61 million in deposits in the same 24 hours, while network-wide DeFi holdings fell 22%.
This was possible because Cronos runs a limited set of 100 validators, small enough to coordinate a halt quickly. The drawback is that everything else stopped too: open loans, trades, payments and automated positions belonging to users who never touched Tectonic.
Crypto.com's CEO, Kris Marszalek, said the exchange and the app were operating normally and that customer funds were safe, promising a post-mortem. Tectonic told depositors not to interact with the protocol until it confirmed it was safe to do so.
Li ranked it as the third Mango-style attack in recent weeks, following one on Moonwell, where manipulation of the illiquid MAMO token cost about $8.7 million, and another on a Pendle reUSD market that triggered roughly $36 million in liquidations on 25 August.
This is not Tectonic's first breach. DefiLlama records two earlier incidents on the protocol, both classified as protocol logic failures: one in February 2024 that cost $250,000, and another in November 2024. It classifies Sunday's attack differently, as oracle manipulation carried out through spot price manipulation, and estimates the loss at $75 million.
Neither Cronos nor Tectonic has provided a restart timeline, confirmed a final figure, or said whether depositors will be fully compensated.
* Translated and edited with permission from Decrypt.
Looking for an alternative to boost your returns? Mercado Bitcoin's Tokenised Fixed Income is the answer: up to 18% return per year, controlled risk and the security your money deserves. Find out more!
