The Cronos network experienced an emergency shutdown on Sunday, following a price manipulation attack on its largest lending protocol, Tectonic, with an estimated $75 million in assets affected. The attacker raised the TONIC token by 100 times within 20 minutes before borrowing and exiting.
(Prior context: Moonwell Base hit again! Collateral price manipulation leads to $8.7M stolen)
(Background: The Mango attacker, who maintains his innocence, has been convicted of market manipulation and faces up to 20 years in prison.)
The Cronos blockchain, owned by Crypto.com, experienced an emergency network outage on Sunday due to a vulnerability exploit on the DeFi lending protocol Tectonic. On-chain analyst Weilin Li estimated that approximately $75 million in assets were affected, but Tectonic has not yet confirmed the actual amount or the cause of the attack.
We identified an exploit in Tectonic.
The Cronos Network has been halted, and we will provide updates here.
— Cronos Network (@CronosNetwork) August 30, 2026
20 minutes, 100x, Mango Markets replay
User Weilin Li noted in X Analysis that the attacker manipulated the price of Tectonic’s governance token, TONIC. As a low-liquidity token, the attacker increased its price by approximately 100 times within 20 minutes and then used the inflated TONIC as collateral to borrow other assets from Tectonic.
This attack mechanism is highly similar to the 2022 hack of Mango Markets, where the attacker stole over $100 million by manipulating the prices of low-liquidity tokens.
It appears @TectonicFi has been exploited for approximately $66M!
The root cause is simple: TONIC, its own governance token, has a 20% collateral factor with very thin liquidity. The attacker performed a Mango-markets-style pump-and-borrow price manipulation attack. TONIC's price surged… pic.twitter.com/cZ2QQNC9C6
— Weilin (William) Li (@hklst4r) August 30, 2026
Tectonic has set a 20% collateral factor for TONIC in the publicly disclosed funding market parameters file, meaning users can borrow up to 20% of the value of their TONIC collateral. According to Li’s tracked attack position, approximately 364.6 trillion TONIC tokens are involved.
To support a $75 million loan, the price of TONIC would need to be approximately $0.00000103, with a total market capitalization of about $375 million—roughly 100 times the pre-attack low of TONIC as shown by CoinGecko data.
75 million MAG affected, 6 million MAG have been cross-chain withdrawn
Li initially estimated that the attacker had acquired approximately $66 million in assets, but later discovered another address controlled by the attacker containing about $8 million, raising the total estimated loss to $75 million.
However, the attackers successfully bridged only about $6 million to Ethereum before Cronos went offline; most of the affected assets remain trapped on the Cronos network. This means that if the Cronos team takes appropriate measures upon restart, they may be able to freeze or recover most of the stolen funds.
Crypto.com was not affected, but is closely related.
Crypto.com CEO Kris Marsalek stated on X platform that the company’s app and exchange were not affected by the attack, and Crypto.com’s security team is assisting Cronos with the investigation. Cronos was originally developed by Crypto.com, but Tectonic is an independent DeFi lending protocol and the first of its kind on Cronos.
According to DefiLlama data, Tectonic’s total value locked (TVL) before the attack was approximately $121.7 million, with active loans totaling about $82.7 million. The $75 million in affected assets indicates that the amount borrowed by the attacker was close to the protocol’s overall loan volume.
Follow-up observation: Plan restart and asset recovery
Cronos has not yet announced plans to restart the network or clarified how the attacker’s assets will be handled after the restart. This will be a critical decision point:
- If no intervention is made during the restart: the attacker may cross-chain withdraw the remaining approximately $69 million in assets, resulting in full losses for Tectonic and users.
- If a hard fork or contract pause is enacted: it may freeze the attacker’s assets, but it will trigger a "decentralization vs. centralization" controversy—Cronos has always been backed by Crypto.com, and the community has long had concerns about this.
Looking at how the Moonwell incident was handled, the Base network team chose to pause the relevant contracts and freeze the attacker’s funds. Whether Cronos will take the same approach remains to be seen.
📍Related Articles📍
Moonwell Base hit again! Collateral price manipulation leads to $8.7 million stolen