Cronos Halts Network After Tectonic Exploit Puts ~$75M at Risk

Cronos halted its blockchain on Sunday after an exploit hit Tectonic, the network’s largest lending protocol, with on-chain researcher Weilin Li estimating roughly $75 million in affected assets. Tectonic has not confirmed the figure or published a root-cause analysis.

Cronos said it had identified an exploit in Tectonic and stopped the network while the incident was investigated. Tectonic separately warned users not to interact with the protocol until it confirms operations are safe.

We identified an exploit in Tectonic.

The Cronos Network has been halted and we’ll provide updates here

— Cronos Network (@CronosNetwork) August 30, 2026

Li’s analysis points to TONIC, Tectonic’s thinly traded governance token. He said the attacker drove its price roughly 100-fold within about 20 minutes before using the inflated tokens as collateral to borrow other assets. An initial estimate of roughly $66 million increased to about $75 million after Li identified another attacker-controlled address holding around $8 million.

Only about $6 million was bridged to Ethereum before Cronos halted, according to Li, leaving most of the exploit-linked assets stranded on the stopped network. Other estimates of the incident have circulated above $75 million, but no final accounting has been confirmed by Tectonic.

TONIC’s collateral design comes into focus

Tectonic’s published money-market parameters list TONIC with a 20% collateral factor, allowing borrowers to take loans worth up to one-fifth of the token’s recognized collateral value.

The protocol’s own documentation also describes the risk created when low-liquidity assets sit inside cross-collateral lending markets. It notes that irregular price movements in one asset can expose other assets in the same pool, while isolated pools are intended to contain that risk.

Tectonic had about $121.7 million in total value locked and $82.7 million in active loans shortly before the incident. Crypto.com CEO Kris Marszalek said the company’s app and exchange were unaffected and that its security team was assisting with the investigation.

Cronos had not announced a restart timetable or explained how the assets remaining on the network would be handled as of the latest available update.