Cronos halted block production on Sunday after identifying an exploit in Tectonic, its largest lending protocol. Independent researcher Weilin Li put the total affected near $75 million, thou
Cronos stopped producing blocks on Sunday after confirming an exploit had hit Tectonic, the lending protocol that carried the largest share of activity on its chain. “We identified an exploit in Tectonic,” Cronos said on X. “The Cronos Network has been halted and we’ll provide updates here.”
We identified an exploit in Tectonic.
The Cronos Network has been halted and we’ll provide updates here
— Cronos Network (@CronosNetwork) August 30, 2026
Tectonic followed with its own warning. “As a precaution, please do not interact with the protocol until we confirm it is safe to do so,” the project said, adding that it was investigating.
We are aware of an incident affecting Tectonic and our team is actively investigating.
As a precaution, please do not interact with the protocol until we confirm it is safe to do so.
We will post a verified update here as soon as we have one.
— Tectonic.cro (@TectonicFi) August 30, 2026
Independent researcher Weilin Li, who tracked the exploit on-chain, said the attacker manipulated the price of TONIC, Tectonic’s governance token, pushing it roughly 100-fold higher in about 20 minutes. Tectonic applied a 20% collateral factor to TONIC, so the inflated price let the attacker borrow other, harder assets against a token that was never worth what the market briefly showed.
TONIC liquidity vs. exploit scale Li initially estimated the attacker had captured about $66 million before identifying a second attacker-controlled address holding roughly $8 million more, raising his total estimate to approximately $75 million. About $6 million reached Ethereum before the halt; Li’s tracking shows most of the rest stayed on Cronos.
The mechanics resemble other crypto security incidents, including the 2022 Mango Markets exploit and the SAND token hack, in which attackers have exploited weaknesses around token pricing, liquidity or protocol security.
Cronos runs on Tendermint consensus with an active validator set capped at 100, a structure that makes a coordinated emergency pause operationally realistic in a way it isn’t on most larger, more decentralized chains. That is what let Cronos trap most of the exploit-linked funds before they left the network, similar to how BNB Chain validators paused that chain within hours of a $570 million bridge exploit in October 2022 and recovered close to $470 million.
The same lever cuts both ways. Stopping block production also froze every other open position, pending transaction, and smart-contract call on Cronos, not just the attacker’s, for as long as the halt lasts.
Crypto.com CEO Kris Marszalek said on X that the exchange’s app and centralized products were unaffected, that customer funds there remained safe, and that the company’s security team was assisting Cronos’s investigation. He said a full postmortem would follow.
There has been a security breach on a Cronos lending protocol Tectonic. Cronos team is investigating, with assistance from https://t.co/JNeHyErmqH security team. https://t.co/JNeHyErmqH app and exchange were not affected and are operating as usual. All funds are safe.
I will…
— Kris (@kris) August 30, 2026
Tectonic held about $121.7 million in total value locked and roughly $82.7 million in active loans immediately before the exploit, according to DefiLlama. Neither Cronos nor Tectonic had released an official cause, a final loss figure, a restart timeline, or a compensation framework as of Monday. Tectonic’s own documentation has previously warned that low-liquidity assets are especially vulnerable to this kind of price manipulation, a risk also seen in incidents such as the Fogo crypto hack, a caveat the protocol’s own collateral rules did not appear to price in for TONIC.
