Cronos Network has halted block production after an exploit targeting Tectonic, its largest lending protocol, placed an estimated $119.5 million in assets at risk, according to on-chain analysis. The attack involved manipulation of Tectonic’s governance token, TONIC, which sharply inflated the value of the attacker’s collateral and enabled substantially larger loans to be drawn.

Cronos is an EVM-compatible blockchain closely associated with Crypto.com, which uses CRO as its ecosystem token, and Tectonic is a Compound- and Aave-style lending market where users deposit assets to earn yield and borrow against collateral. That role makes it a core piece of Cronos’s decentralized finance stack, which is why the incident prompted a chain-level response rather than a protocol-only one.

Tectonic has not yet confirmed the final financial impact. The protocol has launched an investigation and advised users to avoid interacting with the platform until its security has been established.

The scale of the incident remains uncertain because the $119.5 million figure is an on-chain estimate rather than a confirmed loss. Analysis based on a Cronos archive node indicated that the attacker drained approximately $119.5 million from lending pools over roughly 65 minutes.

The same analysis found that only around $1.73 million remained across the affected markets following the activity. It also identified 752 liquidations involving approximately $8.71 million in seized assets, while about $32.6 million in bad debt was reportedly left in the protocol.

TONIC Oracle Manipulation Expanded Borrowing Capacity

The attack appeared to center on an abrupt manipulation of the TONIC token price used by the lending protocol. On-chain data showed that the attacker initially deposited 3,091 TONIC tokens and borrowed 3,697 TONIC within the same block.

About 14 seconds later, the TONIC oracle price increased by roughly 6.46 times in a single block. The sudden price movement significantly raised the reported value of the attacker’s collateral, allowing access to approximately $125.6 million in borrowing capacity.

The exploit demonstrates how manipulation of a lending protocol’s price data can rapidly inflate collateral values and enable borrowing far beyond what the underlying assets would normally support. Oracle manipulation has been a recurring failure mode in decentralized lending, with incidents such as the 2022 Mango Markets attack on Solana and the 2023 BonqDAO exploit on Polygon following a similar pattern of artificially inflating a token’s reported price to extract loans against inflated collateral.

The attacker subsequently withdrew a wide range of assets from the lending markets, including approximately $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH, and 39.61 million CRO, in addition to several other tokens.

According to the on-chain analysis, around $75.7 million of the assets was transferred to an external wallet, while another $43.7 million was directed to a contract address. The movement of those funds and their current status remain part of the investigation.

Tectonic addressed the incident publicly on X:

We are aware of an incident affecting Tectonic and our team is actively investigating. As a precaution, please do not interact with the protocol until we confirm it is safe to do so. We will post a verified update here as soon as we have one.

— Tectonic.cro (@TectonicFi), August 30, 2026 (https://x.com/TectonicFi/status/2094072821630799989)

Cronos Blockchain Halted Following Exploit

Cronos confirmed that it had identified an exploit involving Tectonic and suspended the network while security teams examined the incident. Crypto.com’s security team is also involved in the investigation.

Halting the Cronos blockchain has limited the attacker’s ability to move or further exploit assets that remain on the network, potentially containing additional losses while investigators assess the incident. Network-level halts are a comparatively blunt response and are easier to execute on chains with concentrated validator sets like Cronos than on larger proof-of-stake networks, though they also pause all other activity on the chain.

Crypto.com CEO Kris Marszalek stated on X:

There has been a security breach on a Cronos lending protocol Tectonic. Cronos team is investigating, with assistance from security team. app and exchange were not affected and are operating as usual. All funds are safe. I will…

— Kris (@kris), August 30, 2026 (https://x.com/kris/status/2094081766109982764)

Tectonic separately warned users against interacting with the protocol while the investigation continues. The precautionary measure is intended to prevent additional transactions from complicating the response or exposing users to further losses.

The incident has also raised questions about the resilience of decentralized lending systems that rely on token price oracles to determine collateral values and borrowing limits. A sudden distortion in an oracle price can have significant consequences when lending protocols automatically adjust borrowing capacity based on those valuations. Mitigations such as using multiple independent oracle sources, TWAP-style price smoothing, and conservative collateral caps for low-liquidity governance tokens are widely discussed in DeFi security practice, and whether such measures applied to TONIC will likely be a focus of the post-incident review.

Marszalek said the exploit did not affect Crypto.com’s app or exchange operations and that customer funds held through those services remained safe.

For now, the estimated $119.5 million figure should not be treated as Tectonic’s confirmed loss. The final amount affected, the portion that can potentially be recovered, the handling of the roughly $32.6 million in reported bad debt, and the steps required to restore Cronos operations remain unresolved as the investigation proceeds. How the protocol treats that bad debt — whether via treasury coverage, socialized losses, or another mechanism — will directly affect remaining depositors once the chain resumes.

Tectonic’s warning to users remains in effect, with further details expected as investigators complete their assessment of the exploit and the affected lending markets.