The address associated with the Tectonic hack sent approximately 2,658.9 ETH, equivalent to $6.65 million, into Tornado Cash on September 3. This transaction represents a significant portion of stolen funds that could not be recovered through Cronos's chain rollback following the August 30 incident.
Tornado Cash remains the largest mixer on Ethereum-based networks, making such transactions significant for exchanges, investigators, and traders tracking stolen cryptocurrency movements.
The Rollback's Limitations
When Tectonic, the largest lending platform on Cronos, was compromised on August 30, validators halted the network and restored the chain to block number 90,896,189. The rollback erased nearly all balances associated with the attacker on Cronos but could not reverse funds already transferred to Ethereum.
According to on-chain analysis, approximately $74 million in stolen funds can be traced across three addresses: $60 million in one Cronos wallet, $8 million in a second wallet, and $6 million on Ethereum. The hacker initially moved funds off Cronos as USDC before converting them into approximately 2,500 ETH.
How the Attack Unfolded
The exploit targeted TONIC, a token with minimal market depth and only $305,000 in weekly trading volume before the hack. The attacker increased TONIC's price by approximately 100 times within 20 minutes, then used the inflated token as collateral to extract assets from nine lending protocols.
Tectonic's total value locked collapsed from approximately $121.7 million before the attack to around $3 million following the exploit.
Broader Implications
The incident highlights vulnerabilities in lending protocols that accept thinly traded tokens as collateral. When such tokens lack sufficient market depth, attackers can manipulate prices to unlock disproportionate borrowing power. The attack then spread from a single illiquid token across multiple protocols, requiring a chain-level intervention.
The rollback itself raised concerns about blockchain finality. CRO fell approximately 10 percent over 24 hours during the initial fallout, with continued weakness linked to the exploit and network halt.
Price-manipulation attacks have reached an all-time high in 2026, with 32 recorded incidents so far. August saw 50 major hacks, up 67 percent from July, though total losses declined to $136.3 million.
