Cronos Halts Entire Blockchain After $75M Heist Exploits Governance Token Weakness

Cronos, the blockchain built by Crypto.com, was hit with a massive $75 million heist on Sunday. The attacker targeted Tectonic, the largest lending protocol on Cronos, and exploited its governance token, TONIC, which has barely $1.3 million in liquidity. By pumping TONIC 100-fold in just 20 minutes, the attacker deposited the fake value as collateral and borrowed real assets against it.

This is a familiar tactic known as price manipulation, which was also used to drain over $100 million from Mango Markets back in 2022. It's the third such attack in barely a week, after similar hits on Moonwell and Pendle market. Tectonic's documentation even warned that low-liquidity assets are prone to this type of manipulation.

Cronos quickly responded by halting its entire blockchain, freezing every transaction on the network to stop the attacker from getting away with the money. This move trapped most of the stolen funds, tens of millions of dollars, on the network before they could escape. However, about $6 million did manage to reach Ethereum before the chain went dark.

The halt was effective in stopping the heist, but it also highlights the central tension of decentralized finance - the same centralization that allows for quick responses is what makes 'decentralized' a stretch. The incident has left Tectonic's depositors in limbo, with no timetable to restart the chain and no promise that they will be made whole.