Cronos Halted After $75M Loss from Tectonic Exploit and Pump-and-Borrow Attack

Cronos halted its blockchain on Sunday after detecting an exploit involving Tectonic, a decentralized lending protocol. According to researcher Weilin Li, about $75 million in assets were affected by the exploit.

The attack involved manipulation of TONIC, Tectonic's governance token, which had a 20% collateral factor despite limited market liquidity. The attacker drove TONIC's price roughly 100-fold higher in about 20 minutes, then used the inflated collateral value to borrow other assets from Tectonic.

The exploit is similar to the pump-and-borrow strategy used in the Mango Markets hack, Li said. Initially, he estimated that around $66 million was affected, but later revised his estimate to approximately $75 million after discovering an additional address linked to the attacker holding about $8 million.

Tectonic advised users not to interact with the protocol while it investigates the exploit, and neither Tectonic nor Cronos had confirmed the cause or total losses. Crypto.com Chief Executive Kris Marszalek said the company's app and exchange continued operating normally and that funds held through those services were safe.