The Cronos network remains paused following a significant exploit targeting Tectonic, a money market protocol built on the chain. On August 31, 2026, the attacker drained over $75 million from the protocol by manipulating token prices, prompting Cronos validators to halt block production within hours of the incident.
The attack involved an unconventional approach rather than a traditional code vulnerability. According to industry observers, the attacker spent approximately $600,000 to purchase 16 trillion TONIC tokens across three liquidity pools, inflating the price roughly 40 times. After test transactions, the attacker deposited the inflated TONIC as collateral to borrow nearly $120 million in stablecoins, bitcoin, ether, and CRO tokens.
The network's rapid response trapped approximately $60 million in stolen funds onchain, with reports suggesting only $6 million escaped before the freeze. However, Cronos validators now face a critical dilemma: restarting the network could allow the attacker to move remaining stolen assets, while maintaining the freeze prevents fund transfers but keeps the network suspended.
Tectonic, the largest money market on Cronos, confirmed the attack and advised users to halt protocol activity until security is restored. The protocol's native token TONIC gained 85 percent over the 24 hours following the incident.
Crypto.com CEO Kris Marszalek confirmed the exchange is assisting with the investigation and clarified that Crypto.com itself was not affected by the breach. User funds on the exchange remain secure, he stated.
Security experts noted that the vulnerability stemmed from Tectonic reading spot price data directly from a liquidity pool rather than using a more robust pricing mechanism. This design allowed the attacker to artificially inflate asset valuations and use them as collateral for significantly larger borrowing amounts.
