Cronos has confirmed that about $9.2 million in funds left the network before it could roll back a major exploit involving DeFi lending protocol Tectonic. The attacker manipulated the price o
Cronos has confirmed that about $9.2 million in funds left the network before it could roll back a major exploit involving DeFi lending protocol Tectonic. The attacker manipulated the price of Tectonic’s TONIC token, making it appear far more valuable than it really was. This allowed them to borrow around $120.4 million in assets from different lending markets.
Cronos later rolled the blockchain back by nearly two hours, reversing about $111.2 million of the affected transactions. However, the roughly $9.2 million that had already moved off the network could not be reversed. The rollback removed 10,961 blocks from the chain, effectively taking the network back to its state before the attack.
The incident has brought concerns about using low-liquidity tokens as collateral in DeFi protocols. The attacker was able to repeatedly borrow and deposit TONIC, pushing its price sharply higher and using the inflated value to borrow more valuable assets. Cronos has since resumed normal block production and is working with exchanges, bridges and other crypto infrastructure providers, while efforts to recover the remaining funds continue.
— Cronos Network (@CronosNetwork) September 8, 2026
The incident has also triggered questions within the Cronos community about how the affected funds should be characterized and who ultimately benefited from the intervention.
One criticism challenged the description of the affected assets as “user funds”, arguing that the incident was fundamentally a price-manipulation attack that exploited Tectonic’s lending mechanism rather than a conventional theft of deposited customer funds.
The biggest think I want to know @Fwiz is how much of the 120Mil was owned by @cryptocom by enabling liquidity on @TectonicFi. I bet it’s 95% of “user funds” which is why it was rolled back…
— Johyo | ₿itcoin is Digital 1776 (@Johyo_cro) September 8, 2026
Another community member raised a more specific question: how much of the liquidity involved was supplied by Crypto.com through Tectonic? The implication is that if a large proportion of the affected liquidity came from a major ecosystem participant, the decision to roll back the chain could be viewed differently from a scenario involving thousands of independent users.
The community has also questioned what will happen to the funds recovered through the rollback. While Cronos has outlined how much of the exploited value was reversed, there has been continued interest in how those recovered assets will ultimately be handled.
Meanwhile, Cronos announced a strategic integration with Fireblocks. The partnership is designed to bring institutional-level infrastructure to Cronos, opening the door for professional traders, market makers, and financial institutions to participate in its growing on-chain ecosystem.
Also Read: Taiko Halts Bridge Operations After $1.7 Million Exploit
DeFi lending has become one of the largest parts of the on-chain financial system. In Q1 2026, crypto-collateralized lending stood at $67.42 billion, although it fell 5.1% during the quarter. DeFi lending applications accounted for 41.85% of that market, while DeFi lending combined with collateralized stablecoin systems represented 62.28% of the total.
The attraction for attackers is that lending protocols concentrate large amounts of capital while allowing users to borrow against digital assets without a traditional bank deciding whether a loan should be approved. That automation creates efficiency, but it also means that weaknesses in collateral rules, liquidation systems or protocol logic can potentially affect large pools of funds at once. Academic research describes lending protocols as particularly complex because their incentive mechanisms can create unexpected economic behaviour that attackers may exploit.
The risk is also becoming more interconnected. Research covering more than 4,300 protocols across 602 blockchains found financial relationships between different DeFi platforms, meaning problems at one protocol can potentially spread through other parts of the ecosystem. That interconnectedness makes lending security a market-wide issue rather than a concern for individual platforms.
The number of attacks has risen sharply even though the amount stolen has not increased at the same pace. TRM Labs recorded 207 crypto hacks in the first half of 2026, more than double the 83 recorded during the same period in 2025. Yet losses fell to $972 million, compared with $2.3 billion in H1 2025. The figures suggest that attackers are conducting attacks more frequently, while the average financial impact varies between incidents.
The biggest think I want to know @Fwiz is how much of the 120Mil was owned by @cryptocom by enabling liquidity on @TectonicFi. I bet it’s 95% of “user funds” which is why it was rolled back…
— Johyo | ₿itcoin is Digital 1776 (@Johyo_cro) September 8, 2026
DeFi’s security picture has also changed over time. Immunefi estimates that DeFi protocol losses reached $680 million in 2025, down substantially from the $2.62 billion peak recorded in 2022. The median loss per incident also dropped from $6 million to $1.5 million between 2022 and 2025. However, the decline in average losses does not mean the underlying risk has disappeared, particularly as DeFi’s overall capital base has continued to expand.
Another concern is that security failures are not always caused by an obvious coding error. A 2026 academic analysis of 135 DeFi security incidents found that, among incidents where audit history could be identified, 67.6% of attack paths by count fell outside the scope of identified pre-incident audits. This points to a broader challenge: auditing a smart contract does not necessarily mean that every economic, governance or operational risk surrounding a protocol has been tested.
Enjoyed this? BookmarkDeFi Planet, explore related topics, and follow us onTwitter,LinkedIn,Facebook,Instagram,Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
The post Cronos Post-Mortem Confirms $9.2M Lost Before Tectonic $120M Rollback appeared first on DeFi Planet.
