Cronos Blockchain Pauses After Tectonic Lending Exploit, $119.5M at Risk

Cronos Network has paused operations after an exploit hit Tectonic, its lending protocol, with on-chain analysis estimating that about $119.5 million was drained from lending pools. 

Tectonic has not confirmed the final loss, but its team is investigating as users are warned not to interact with the protocol.

Tectonic Exploit Puts $119.5M in Pools at Risk

Following the attack, Tectonic responded quickly by posting on X, saying it was aware of the incident and urged users to stop using the protocol until the platform is confirmed to be safe.

“As a precaution, please do not interact with the protocol until we confirm it is safe to do so.”

The size of the loss remains the biggest unanswered question. Tectonic has not published a confirmed figure. However, an on-chain analysis using a Cronos archive node estimates that about $119.5 million was drained in 65 minutes.

The analysis also shows only about $1.73 million remained across the affected markets. It recorded 752 liquidations involving roughly $8.71 million seized from other users, while about $32.6 million in bad debt was left behind.

TONIC Price Manipulation Triggered the Attack

The exploit centered on the price of Tectonic’s TONIC token. According to the on-chain analysis, the attacker first deposited 3,091 TONIC and borrowed 3,697 TONIC in the same block.

Just 14 seconds later, the TONIC oracle price jumped 6.46 times in a single block. This sharply increased the value of the attacker’s collateral and allowed about $125.6 million in borrowing.

The attacker then withdrew assets including $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH, and 39.61 million CRO, along with several other tokens.

The analysis shows about $75.7 million was sent to an external wallet, while another $43.7 million went to a contract address.

Cronos Halts Network as Investigation Continues

Cronos Network even confirmed the exploit and halted the network while its team investigated with help from Crypto.com’s security team.

Crypto.com CEO Kris Marszalek said the company’s app and exchange were not affected and that customer funds remained safe.

For now, the $119.5 million figure remains an on-chain estimate, not a confirmed Tectonic loss.