$75M Drained, Most Funds Trapped
The Cronos blockchain came to a standstill on Sunday after a devastating exploit hit Tectonic, its largest decentralized lending protocol. The attack resulted in an estimated $75 million being siphoned from the platform, with on-chain data showing that only about $6 million managed to escape to Ethereum before the network was halted. The rest—roughly $60 million—remains locked within the Cronos ecosystem at the time of writing.
Tectonic, which previously held over $120 million in total value locked as of August 26, saw its TVL plummet to just $3 million following the incident. This collapse underscores the scale of the exploit’s impact on Cronos’s DeFi landscape.
Mimas Finance, the next-largest lender on Cronos, holds only about $30,000 according to DefiLlama.
Price Pump Fueled the Attack
The mechanics of the exploit involved a rapid and artificial surge in TONIC—the governance token for Tectonic. The attacker manipulated TONIC’s price, inflating it by approximately 100 times within a mere 20 minutes. By leveraging Tectonic’s 20% collateral factor for TONIC and exploiting thin liquidity, they deposited these overvalued tokens as collateral and borrowed other assets against them.
This method mirrors tactics seen in previous DeFi attacks, where illiquid governance tokens with high collateral factors become prime targets for price manipulation. According to unchainedcrypto.com, researcher Weilin Li described this as a “Mango Markets-style pump-and-borrow price manipulation attack.”
See Also
TONIC Token Skyrocketed Before Exploit
In less than half an hour, TONIC’s price skyrocketed 100-fold—a move that set the stage for one of DeFi’s most damaging exploits in recent memory.
The attacker’s strategy hinged on this dramatic price movement. By artificially inflating TONIC’s value and then using it as collateral, they were able to drain tens of millions from Tectonic before validators could react. Security firm PeckShield later confirmed that around $74 million was exploited during this window.
No Timeline for Blockchain Restart
Despite widespread attention and user concern, neither Cronos nor Tectonic has provided details about when—or if—the blockchain will resume operations. Both platforms have refrained from confirming the exact amount lost or offering any explanation regarding the exploit’s root cause. For now, users are left waiting without a clear timeline for recovery.
This uncertainty stands in contrast to Crypto.com CEO Kris Marszalek's statement that his company’s app and exchange remain unaffected by the incident and continue operating normally. While Cronos faces its most severe security crisis yet, Crypto.com has sought to reassure users that its centralized services are insulated from DeFi vulnerabilities on its affiliated blockchain.
Exploit Mirrors Mango Markets Tactics
The method used bears striking resemblance to last year’s Mango Markets hack—a precedent where attackers similarly manipulated a token’s price before borrowing against inflated collateral. In both cases, thin liquidity enabled flash price manipulation at scale, exposing critical weaknesses in DeFi protocol design.
On August 30, 2026, Cronos publicly acknowledged the exploit via social media and halted block production to contain further losses. The decision to pause an entire blockchain is rare and highlights both the severity of this event and the unique risks facing networks with tightly integrated DeFi protocols.
There is a tension here: while halting Cronos may have prevented additional funds from being bridged out by attackers, it also traps user assets indefinitely until a resolution is found.
Key signals ahead
If Cronos announces a timeline for restarting its halted blockchain—currently paused with around $60 million from the Tectonic exploit still stuck on-chain—immediate attention will turn to whether those funds remain secured or are moved upon resumption; as of now, no restart date has been confirmed.