Cronos Network halted operations following an exploit that affected Tectonic, its lending protocol. On-chain analysis estimates that approximately $119.5 million was drained from lending pools, though Tectonic has not published a confirmed loss figure.
The Tectonic team responded by warning users to stop interacting with the protocol until safety could be confirmed. According to the on-chain analysis, only about $1.73 million remained across affected markets after the attack, with 752 liquidations resulting in roughly $8.71 million seized from other users and approximately $32.6 million in bad debt left behind.
Price Manipulation Triggered the Attack
The exploit centered on manipulation of the TONIC token price. The attacker deposited 3,091 TONIC and borrowed 3,697 TONIC in the same block. Fourteen seconds later, the TONIC oracle price increased 6.46 times in a single block, sharply raising the value of the attacker's collateral and enabling approximately $125.6 million in borrowing.
The attacker then withdrew $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH, 39.61 million CRO, and several other tokens. Of the estimated loss, approximately $75.7 million was sent to an external wallet while another $43.7 million went to a contract address.
Cronos Network Response
Cronos Network confirmed the exploit and halted the network while its team investigated with assistance from Crypto.com's security team. Crypto.com CEO Kris Marszalek stated that the company's app and exchange were not affected and that customer funds remained safe.
