Aug 31, 2026, 12:57 a.m. EDT
2 min read
Summary
- Cronos paused its blockchain on Sunday after a malicious actor manipulated the valuation of Tectonic’s scarcely traded TONIC token, allowing them to borrow authentic assets against artificially inflated collateral in an attack estimated at approximately $75 million.
- Data from DefiLlama indicates that Tectonic’s total value locked collapsed from roughly $121.7 million on August 26 down to about $3 million by Monday.
- As of Monday morning, neither Cronos nor Tectonic had issued a schedule for bringing the network back online or officially verified the total losses.
Cronos froze its entire distributed ledger on Sunday after Tectonic, its premier lending protocol, fell victim to an exploit valued at roughly $75 million.
Introduced by Crypto.com in 2021, Cronos is a blockchain tightly integrated with the exchange, which utilizes the network to facilitate lower-cost transactions for its proprietary offerings. Its native CRO coin serves as the centerpiece of the Crypto.com ecosystem, and the network supports a modest collection of decentralized finance and trading applications, with Tectonic acting as the largest among them.
Tectonic permits participants to deposit digital currencies and take out loans in other assets against those holdings, functioning similarly to using real estate as security for a bank loan.
Among the digital assets accepted as collateral was TONIC, the protocol’s native token, which possessed roughly $1.34 million in liquidity alongside a daily trading volume of approximately $11,000. Official documentation from Tectonic explicitly cautions that assets with low liquidity are especially vulnerable to price manipulation.
On-chain records suggest this vulnerability provided the entry point for the attack, as an aggressor spiked the market price of TONIC by roughly 100 times over a span of about 20 minutes, deposited those newly inflated tokens into Tectonic, and proceeded to borrow genuine crypto assets against them.
Because TONIC maintained a 20% collateral factor, every $100 in protocol-recognized value could back approximately $20 in borrowing capacity.
Publicly available metrics already reveal catastrophic damage. According to DefiLlama, Tectonic held roughly $121.7 million in locked assets on August 26—representing nearly half of all capital deposited across the Cronos DeFi sector. By Monday, that metric had plummeted to approximately $3 million.
Cronos operates on software that limits its infrastructure to 100 validators, which are entities providing the computational power needed to maintain and secure the network. This small group size makes it feasible to coordinate a network shutdown within minutes.
BNB Chain executed a similar maneuver in October 2022, when 26 validators halted operations following a bridge exploit to successfully retrieve nearly $470 million of the $570 million stolen. The downside is that all other user transactions freeze concurrently, demonstrating that blockchains capable of being manually switched off possess compromised neutrality.
This incident arrives on the heels of a comparable exploit targeting the Moonwell lending platform during the previous week, where an attacker similarly distorted the price of a low-liquidity collateral token. Base, the network hosting Moonwell, kept producing blocks while funds drained from the protocol. Additionally last week, a minor 3% price shift within an illiquid Pendle pool sparked approximately $36 million in forced liquidations on Morpho.
Prior to Sunday, Tectonic’s most recent public updates dated back to June and May, during which time the project advised users to withdraw a specific asset and lowered borrowing limits for others.
By Monday morning, leadership teams for both Cronos and Tectonic had not yet released a timeline for network resumption or an authenticated accounting of the financial damage.
Originally published at https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic.
