Cronos, the blockchain network associated with exchange Crypto.com, stopped producing blocks Sunday after an attacker manipulated the price of a thinly traded token to drain an estimated $75 million from the network's largest lending protocol. [1] Validators halted the entire chain mid-attack, freezing every open position on Cronos — including ones belonging to users who had never touched the exploited protocol — in order to trap the bulk of the stolen funds before they could leave the network. [2]
The target was Tectonic, a lending protocol that let users deposit crypto for others to borrow against, and which held close to half of all capital deposited across Cronos's entire DeFi ecosystem before the attack — roughly $121.7 million in deposits and $82.7 million in active loans, according to DefiLlama data cited by The Block. [1] Onchain researcher Weilin Li, writing on X, described the attack as "a Mango-market style pump-and-borrow price manipulation attack," a reference to the 2022 exploit of Mango Markets. [2] Tectonic's governance token, TONIC, traded on roughly $1.34 million in liquidity — thin enough that the attacker pushed its price up 100-fold within about 20 minutes, then used the artificially inflated tokens as collateral to borrow other assets from the protocol. [1] [2]
Tectonic's own published parameters assigned TONIC a 20 percent collateral factor despite that thin liquidity, letting the attacker draw roughly a fifth of a valuation the market could never have organically supported. [2] Li initially estimated the attacker's haul at $66 million before identifying a second attacker-controlled address holding another $8 million, bringing the total closer to $75 million; security firm PeckShield separately estimated the loss at roughly $74 million, a close match. [1] [2]
The halt worked as containment, if not prevention. Only about $6 million of the stolen funds reached Ethereum before Cronos's validators froze block production, leaving an estimated $60 million immobilized on a chain that had not resumed normal operation as of Monday. [2] Cronos runs a capped set of 100 validators, small enough to coordinate an emergency stop quickly — a structural feature that made the halt possible but that also meant every unrelated transaction on the network stopped along with the attacker's. [2] Crypto.com chief executive Kris Marszalek said on X that the exchange's own app and trading platform were unaffected and that customer funds were safe, and that the company's security team was assisting Cronos with the investigation. [1] [2]
Tectonic told depositors not to interact with the protocol until it could confirm doing so was safe, and neither Tectonic nor Cronos had disclosed a restart timeline, a final confirmed loss figure, or whether affected depositors would be made whole as of Monday. [1] [2] Li flagged the attack as the third Mango-style price-manipulation exploit in recent weeks, following an $8.7 million incident on the Base network's Moonwell protocol and an August 25 attack on a thinly traded Pendle market that triggered roughly $36 million in liquidations elsewhere. [2] DefiLlama records show Tectonic had already suffered two smaller breaches, in February and November 2024, both classified as protocol logic failures rather than oracle manipulation. [2]
The response is where mainstream and crypto-native readings of the incident diverge. The Block and Decrypt both frame the halt as effective crisis management — a chain that acted fast enough to trap the majority of stolen funds before they escaped. Onchain commentary on X has drawn a different lesson from the identical fact: a network whose validators can coordinate a full shutdown within minutes of an exploit is not, whatever its marketing says, meaningfully decentralized in the way that matters during a crisis. Both readings rest on the same 100-validator architecture. They simply disagree about whether that architecture is Cronos's safety feature or its tell.
-- THEO KAPLAN, San Francisco