Cronos Halts Chain After $75M Tectonic Exploit, TONIC Pumped 100x in 20 Minutes

Cronos, the Crypto.com-linked blockchain, halted network operations on Sunday after an exploit against the decentralized lending protocol Tectonic put an estimated $75 million at risk. Cointelegraph and The Block both confirmed the halt and the $75 million figure independently, making the scale of the loss the one number both outlets agree on. The precise mechanics of the attack, however, trace back to a single researcher whose analysis both outlets cite.

What two sources confirm, and what rests on one

Cronos said it had identified an exploit targeting Tectonic and paused the chain while it investigated, promising further updates. Tectonic separately told users not to interact with the protocol during the review. Both details appear across the two independent reports, which is enough to treat the halt itself as a verified fact rather than a single-source claim.

The granular breakdown of the attack, however, comes from researcher Weilin Li and is repeated by both outlets rather than independently derived by each. Li said the attacker exploited TONIC’s 20% collateral factor combined with thin liquidity, pushing the governance token’s price up roughly 100-fold within 20 minutes before borrowing against the inflated collateral. Li described the technique as a “Mango-market style” pump-and-borrow attack, a reference to the 2022 Mango Markets exploit that used a similar price-manipulation-then-borrow sequence.

The number kept moving: $66M, then $75M

Li’s estimate was not static. He first put the affected amount at $66 million, then said the attacker bridged roughly $6 million to Ethereum before the Cronos halt, leaving about $60 million still on the Cronos network. He later flagged a second attacker-controlled address holding an additional $8 million, pushing his running estimate to approximately $75 million, the figure both outlets ultimately reported.

That evolution matters for anyone pulling numbers from an aggregated snapshot rather than the original source. A reader checking a dashboard an hour after the halt could have seen $66 million; a reader checking now sees $75 million. Neither figure is wrong, they simply reflect different points in an ongoing on-chain forensic count, not a correction of an error.

Crypto.com says its exchange was unaffected

Crypto.com CEO Kris Marszalek said the exchange’s app and trading platform continued operating normally throughout the incident and that customer funds there remained safe. This claim is separate from the Cronos chain halt itself: Cronos is the blockchain infrastructure Crypto.com helped build, while the exchange app runs its own custodial systems.

Neither Cronos nor Tectonic has confirmed the root cause of the exploit or the final loss figure as of publication. No restart timeline for the network has been announced. Neither project has said whether it will attempt to freeze the attacker’s addresses, pursue recovery, or compensate affected users.

What remains unverified

Cointelegraph reported it had contacted Cronos, Tectonic and Crypto.com for comment without confirmation at the time of publication. That leaves the incident in a state familiar to anyone tracking on-chain exploits in real time: the halt is confirmed, the rough loss magnitude is converging around $75 million across two outlets, but the exact addresses, the fate of the funds, and any compensation plan remain open questions pending an official post-mortem from either project.

Sources

• cointelegraph.com
• theblock.co