Cronos Halts Entire Blockchain After $75M Tectonic Exploit, Trapping $60M

A Whole Blockchain Pulls the Emergency Brake

Cronos, the blockchain closely linked to Crypto.com, stopped producing blocks on Sunday after an attacker drained an estimated $75 million from Tectonic, the network’s largest lending protocol, according to The Block.

It is one of the most dramatic responses to a hack in recent memory. Rather than watch the stolen funds escape, the network’s operators switched the whole chain off.

The move appears to have worked, at least in part. Only about $6 million left the network before the freeze took hold.

A 100x Token Pump in 20 Minutes

The attack targeted TONIC, Tectonic’s own governance token, and it moved fast. Onchain researcher Weilin Li, who first flagged the incident, said the attacker pushed TONIC’s price up roughly 100 times in about 20 minutes, Cointelegraph reported.

TONIC is a thinly traded token, so even modest buying pressure can move its price violently. Once the price was inflated, the attacker deposited the pumped tokens into Tectonic as collateral and borrowed real assets against them.

Li initially estimated the damage at $66 million, then revised it to roughly $75 million as more attacker-controlled addresses surfaced, including one holding a further $8 million. Tectonic has not confirmed the final figure or the root cause, and it has warned users not to interact with the protocol while it investigates.

Researchers compared the method to the 2022 Mango Markets attack, one of the most infamous exploits in DeFi history.

How Inflated Collateral Unlocks Real Money

Lending protocols like Tectonic work like automated pawn shops. Users deposit one asset as collateral and borrow a different one against it, up to a set percentage of the collateral’s value.

Tectonic gave TONIC a 20% collateral factor. Deposit $100 worth of TONIC, and the protocol lets you borrow up to $20 worth of other tokens, such as stablecoins or wrapped Bitcoin.

That math only holds if the price is honest. When an attacker pumps the collateral token to 100 times its real value, the protocol believes $100 of TONIC is worth $10,000 and hands over real assets against the phantom number.

The borrowed funds are real and instantly movable. The collateral backing them becomes nearly worthless the moment the artificial pump unwinds. That gap is the theft, and thinly traded tokens with generous collateral settings are the easiest place to open it.

The Halt Trapped $60 Million Mid-Escape

The attacker began bridging funds to Ethereum immediately, moving about $6 million before Cronos validators halted the chain. Li estimates that roughly $60 million remains stranded in attacker-controlled addresses on the frozen network.

Crypto.com CEO Kris Marszalek said the company’s app and exchange were unaffected and operating normally, and that its security team is assisting the investigation.

That distinction matters for everyday users. Tectonic is a DeFi application running on Cronos, not a custodial product, so funds held on a best crypto exchange sit in a different risk category from deposits parked in an onchain lending pool.

Tectonic’s Deposits Collapse From $122M to $3M

The protocol’s total value locked tells the story in one line. Tectonic held about $122 million in deposits heading into the weekend. By Monday that figure had collapsed to roughly $3 million, according to DefiLlama data.

The exploit also caps a bruising stretch for crypto security. It comes just two days after The Sandbox promised 1:1 refunds for a bridge hack that minted 339 trillion SAND from a $700K exploit.

Traders spent Monday watching CRO and broader crypto prices for signs of contagion. So far the damage appears contained to the Cronos ecosystem rather than spilling into the wider market.

Will Validators Freeze, Restart or Roll Back?

Neither Cronos nor Tectonic has announced a restart timeline, and no recovery plan has been confirmed.

When a halted network comes back online, its operators face three broad options. They could restart the chain untouched, which may let the attacker resume moving funds. They could freeze the attacker’s addresses at the protocol level. Or they could attempt a rollback, rewinding the ledger to a state before the exploit.

Each path carries a cost. Freezing or rolling back could protect victims, but it may invite accusations that the chain is centrally controlled. Restarting untouched preserves neutrality, but it could hand the attacker access to $60 million.

Whatever Cronos decides could set a precedent for how exchange-linked blockchains respond to eight-figure exploits in the future.

The Emergency Brake Cuts Both Ways

The halt may have saved $60 million. It also proved that a small group of operators can stop an entire public blockchain, a power that sits uneasily beside crypto’s core promise of unstoppable, neutral infrastructure.

That tension is now the story to watch. If Cronos freezes or claws back the funds, users of exchange-linked chains may come to expect that kind of protection as standard. If it restarts the network untouched, the market learns the emergency brake exists but will not be pulled.

Either way, the episode shows how a $75 million hole can open through nothing more exotic than a thin token and a generous collateral setting. For an industry still rebuilding trust after a heavy month of exploits, how Cronos handles the next week could matter more than the hack itself.