The address linked to the Tectonic hack transferred approximately 2,658.9 ETH, worth about $6.65 million, into Tornado Cash on September 3 (UTC), according to blockchain security firm PeckShield. The movement represents a substantial portion of the funds that remained unrecovered after Cronos validators rolled back the chain following the August 30 incident.

The destination matters well beyond Cronos itself. Tornado Cash remains the largest mixer on Ethereum-based networks, which makes the transaction relevant to exchanges, investigators, and analysts who trace stolen cryptocurrency. Once funds pass through the mixer, they are broken into smaller deposits that obscure the on-chain link between the source and exit addresses, which is why investigators monitor deposits like this one in near real time even though recovery becomes far harder.

The funds the rollback could not reach

When Tectonic, Cronos's largest lending platform, was drained on August 30, validators halted the network almost immediately. Cronos subsequently stated that it restored the chain to its pre-attack state and resumed block production from block number 90,896,189.

The rollback erased nearly all attacker-controlled balances on Cronos, but it could not reverse funds that had already reached Ethereum. That split outcome highlights a structural limit of chain-level responses: they can contain damage on the affected network, but assets bridged to other chains before a halt stay outside their reach.

PeckShield estimates that roughly $74 million in stolen funds can be traced across three addresses: approximately $60 million in one Cronos wallet, $8 million in a second, and $6 million on Ethereum. The Defiant reported that at the time, the Ethereum balance stood at 2,592.2152 ETH, worth $6.29 million. TRM Labs data indicated the attacker initially moved those funds off Cronos via USDC before converting them into roughly 2,500 ETH.

Discrepancies exist between loss estimates. This article uses the $75 million figure, based on reporting by TRM Labs and on-chain researcher Weilin Li. PeckShield's roughly $74 million figure reflects the rounded-up total from the three tracked addresses. The $119.5 million estimate comes from a broader archive-node reconstruction that includes a contract set up by the attackers before the exploit occurred.

A 100x pump that hollowed out Cronos's largest lender

The attack targeted a token with little market depth. TRM Labs noted that TONIC recorded only $305,000 in trading volume in the week before the hack, despite carrying a 20% collateral ratio.

According to security firm Halborn, the attacker inflated the price of TONIC roughly 100-fold within 20 minutes, then used the artificially valued token to borrow harder assets from nine lending protocols.

Earlier reporting by Cryptopolitan indicated that the estimated loss rose from approximately $66 million to around $75 million after Li identified a second attacker wallet. Tectonic's total value locked (TVL) collapsed from roughly $121.7 million before the hack to about $3 million, according to DeFiLlama.

Why a $6.65 million deposit ripples beyond Cronos

Although the Tornado Cash deposit is small relative to the broader crypto market, its routing is significant. TRM Labs reported that Tornado Cash had received more than $700 million by June 2026 and remained the largest mixer on Ethereum-based networks.

TRM has also documented its use by ransomware groups, cybercriminals, and North Korea's Lazarus Group, while noting that the protocol also serves legitimate privacy purposes. The US Treasury removed Tornado Cash from its sanctions list on March 21, 2025.

Cronos's response also raised a separate concern: finality. Halborn said the rollback limited the damage but came at the cost of confidence in ledger immutability. Cryptopolitan reported that CRO fell roughly 10% over 24 hours during the initial fallout, while CoinMarketCap later linked continued weakness to the exploit, the network halt, and the rollback.

A record year for price-manipulation attacks

The Tectonic incident fits a wider security trend. PeckShield counted 50 major hacks in August, up 67% from July's 30, although total losses fell 49.5% to $136.3 million from $270 million. Tectonic was August's largest incident and ranked as the fourth-largest crypto theft of 2026 at the time.

TRM Labs says price-manipulation exploits have already reached an all-time high in 2026, with 32 recorded so far.

The underlying weakness is not always faulty code. When thinly traded collateral is granted meaningful borrowing power, attackers can target the price a protocol relies on. Tectonic illustrates how quickly such risk propagates — from an illiquid token, to a lending protocol, to a chain rollback, and ultimately into the cross-chain laundering ecosystem. For platforms listing collateral tokens and for teams weighing emergency interventions, the episode leaves open questions each side will be watching as protocols reassess listing standards and as investigators track the remaining traced balances.