Key Points

• Cronos halted its network after an exploit targeting DeFi lending protocol Tectonic was estimated to involve roughly $75 million in assets.
• The attack allegedly manipulated TONIC’s price and exploited its 20% collateral factor and thin liquidity in a rapid pump-and-borrow strategy.
• Crypto.com said its app and centralized exchange were unaffected, while questions remain over recovery, user compensation and Cronos’ network restart.

Cronos halted its blockchain after an exploit targeting decentralized lending protocol Tectonic was estimated to involve about $75 million, highlighting the continuing risks created by thin liquidity and volatile collateral in decentralized finance. Most of the assets were reportedly still on Cronos after the network was paused, potentially giving the ecosystem time to assess the damage and determine whether funds can be recovered.

Cronos said Sunday that it had identified an exploit involving Tectonic and halted the network while it investigated. Tectonic separately warned users not to interact with the protocol. Neither project had confirmed the precise cause of the incident or the final amount lost at the time of publication.

Price manipulation drives suspected attack

Blockchain researcher Weilin Li attributed the incident to a rapid manipulation of TONIC, Tectonic’s governance token. According to Li, the attacker exploited a 20% collateral factor combined with limited liquidity, pushing TONIC’s price roughly 100-fold within 20 minutes.

The resulting price distortion allegedly allowed the attacker to use the inflated token valuation as collateral to borrow other assets. Li characterized the incident as a “Mango-market style” pump-and-borrow attack, referring to a broader class of DeFi exploits in which an attacker artificially increases the value of collateral before borrowing against it.

Li initially estimated that approximately $66 million was affected. Around $6 million was reportedly bridged to Ethereum before Cronos halted the network, leaving roughly $60 million on Cronos. He later identified another attacker-controlled address holding about $8 million, bringing his estimate of the total exposure to approximately $75 million.

The figures remain estimates rather than confirmed losses, underscoring the uncertainty surrounding the incident while the investigation continues.

Cronos halt puts DeFi infrastructure under scrutiny

The decision to halt Cronos demonstrates the trade-off between decentralized financial infrastructure and centralized emergency intervention. While stopping transaction processing can potentially limit an attacker’s ability to move stolen assets, it also raises questions about governance, operational control and the resilience of applications built on the network.

Tectonic’s exposure to rapidly changing collateral values is particularly significant. Lending protocols depend on reliable pricing mechanisms and sufficient market liquidity to ensure collateral can be liquidated when borrowers become undercollateralized. Thin liquidity can make those mechanisms vulnerable to manipulation, especially when governance tokens are accepted as collateral.

The incident therefore extends beyond the immediate financial loss. It illustrates how weaknesses in one DeFi application can create network-level consequences when the affected assets and liquidity are concentrated within a single blockchain ecosystem.

Crypto.com says operations remain unaffected

Crypto.com CEO Kris Marszalek said the company’s app and centralized exchange were operating normally and that customer funds held through those services were safe.

That distinction is important because the exploit targeted Tectonic, rather than Crypto.com’s centralized trading infrastructure. Nevertheless, the incident places additional attention on Cronos, particularly as users and developers assess whether the network can resume operations without further asset movements by the attacker.

Cronos and Tectonic had not announced a restart timeline, asset recovery strategy or compensation plan at the time of publication. They had also not confirmed whether attacker-controlled addresses would be restricted.

The next phase will depend on forensic analysis, asset tracing and decisions over whether the affected funds can be frozen or recovered. For DeFi investors, the episode reinforces the importance of collateral quality, liquidity depth and oracle resilience alongside headline yields. For Cronos, restoring confidence may depend as much on the transparency of its response as on the technical measures used to secure the network.