Cronos halted block production on Aug. 30 after detecting an exploit involving Tectonic, a decentralized lending protocol operating on the blockchain.
Independent researcher Weilin Li estimated that approximately $75 million was affected. However, neither Cronos nor Tectonic had confirmed the cause or total loss as of Aug. 31.
Most of the identified assets appeared to remain on Cronos after validators stopped the network. No restart time, recovery plan or compensation framework had been announced.
Tectonic exploit reportedly used inflated TONIC collateral
Li attributed the incident to the treatment of TONIC, Tectonics governance token, as collateral. TONIC reportedly had a 20% collateral factor despite limited market liquidity.
According to his initial analysis, the attacker increased TONICs market price roughly 100-fold over about 20 minutes. The attacker then supplied the inflated tokens as collateral and borrowed other assets from Tectonic.
Li described the incident as a “Mango-market style” pump-and-borrow attack. The characterization remains an independent assessment because Tectonic has not published its own technical post-mortem.
The reported pattern resembles earlier attacks in which thinly traded collateral was assigned an inflated valuation. As crypto.news reported, a similar collateral-price attack drained Moonwell of an estimated $8.7 million shortly before the Tectonic incident.
Cronos halt kept most identified funds onchain
Li initially placed the affected assets at approximately $66 million. He said around $6 million crossed to Ethereum before Cronos validators halted block production, while roughly $60 million remained at a Cronos address.
The researcher later identified another address holding approximately $8 million, raising his combined estimate to around $75 million. Those figures remain estimates based on address attribution and token valuations.
Update, another attacker controlled address with ~8M on Cronos: https://t.co/CjZgR36ZwD.
Making total loss at around 75M.
— Weilin (William) Li (@hklst4r) August 30, 2026
The fact that assets remain on Cronos does not mean they have been recovered. A network restart could allow the attacker to resume moving funds unless validators, protocol developers or other participants introduce restrictions.
Cronos and Tectonic have not said whether they intend to freeze the identified addresses, reverse transactions or negotiate with the attacker. Any intervention could also raise questions about network governance and transaction finality.
Crypto.com says its exchange was unaffected
Crypto.com CEO Kris Marszalek said the companys app and centralized exchange continued operating normally. “All funds are safe,” he wrote, referring to assets held through those Crypto.com services.
That statement does not cover funds deposited directly into Tectonic. Crypto.com and Cronos are closely associated, but Tectonic operates as a separate decentralized lending application on the network.
Marszalek said Crypto.coms security team was assisting with the investigation. He also promised a full post-mortem, although no publication date was provided.
The incident illustrates the difference between centralized exchange balances, blockchain-held assets and funds deposited into DeFi contracts. A failure affecting one layer does not necessarily compromise every service connected to the same ecosystem.
Cronos restart depends on containment and accounting
Cronos must determine whether the identified addresses can move funds safely before restoring block production. Validators will also need to assess whether the attacker left bad debt inside Tectonics lending markets.
Tectonic separately warned users not to interact with the protocol until it confirms that doing so is safe. Deposits, repayments, liquidations and withdrawals remain affected while the blockchain is halted.
A technical review must establish how Tectonic valued TONIC collateral and whether its price source included sufficient protections against manipulation. Crypto.news has previously explained how weak oracles can expose lending protocols to manipulated collateral prices.
The incident also resembles the Mango Markets manipulation, where inflated governance-token collateral supported loans against more liquid assets.
The next confirmed updates should address the network restart, the final asset total, Tectonics outstanding bad debt and possible treatment of affected depositors. No verified market movement in CRO or TONIC was included because a reliable event-specific price reaction had not been established.