The Cronos blockchain, the layer-1 network closely associated with Crypto.com, stopped producing blocks on Sunday, August 30, 2026, after an exploit hit Tectonic, the chain’s dominant decentralized lending protocol.
Validators coordinated a full halt within minutes of detecting the incident, freezing transfers, bridges, and smart contract activity across the entire network rather than isolating a single application.
Tectonic had been the center of Cronos DeFi.
Shortly before the attack it held roughly $122 million in total value locked and about $83 million in outstanding loans, accounting for nearly half of all capital deposited on the chain.
Its own governance token, TONIC, was far thinner: liquidity sat near $1.3 million and daily trading volume was only about $11,000.
The protocol still assigned TONIC a 20 percent collateral factor, meaning the system would treat the token as borrowable collateral despite its shallow markets.
On-chain researcher Weilin Li described the attack as a rapid price-manipulation scheme similar to the 2022 Mango Markets exploit.
In roughly 20 minutes the attacker drove TONIC’s price up about 100 times, deposited the inflated holdings as collateral, and borrowed more liquid assets against that artificial value.
Li first estimated roughly $66 million had been extracted, then identified a second address holding about $8 million and raised the total to approximately $75 million.
Security firm PeckShield independently placed the figure near $74 million.Most of the proceeds never left Cronos.
Only about $6 million was bridged to Ethereum before validators paused the chain; the remainder, on the order of $60 million to $68 million depending on the tracker, remained in addresses on Cronos.
We identified an exploit in Tectonic.
The Cronos Network has been halted and we’ll provide updates here
— Cronos Network (@CronosNetwork) August 30, 2026
DefiLlama data showed Tectonic’s TVL collapsing from more than $121 million a few days earlier to around $3 million by Monday.
The incident also triggered millions of dollars in liquidations and left substantial bad debt on the protocol.
Cronos Network announced the halt on X, stating it had identified an exploit in Tectonic and would provide further updates.
Tectonic separately told users not to interact with the protocol until it confirmed it was safe.
Crypto.com CEO Kris Marszalek said the company’s centralized exchange and app were unaffected and continued operating normally.
Neither Cronos nor Tectonic had, as of Monday morning, confirmed a precise loss figure, a root-cause analysis, a restart timetable, or a plan for depositors.
The small validator set—capped at 100 under Cronos’s Tendermint-based design—made a coordinated pause feasible.
That same architecture now forces a difficult choice: restart without intervention and leave the attacker’s holdings in place, attempt to blacklist or recover funds, or consider a rollback.
Each option carries trade-offs for users who had no connection to Tectonic yet cannot move assets while the chain is frozen. The episode underscores a recurring DeFi risk: protocols that accept low-liquidity tokens as collateral remain exposed to oracle and price-manipulation attacks even when the underlying chain can still halt in an emergency.
Credit: Source link
