Security · Developing
To Keep the Rest, Cronos Turned the Blockchain Off
An attacker inflated Tectonic's own governance token, borrowed the chain's real assets against the number, and moved roughly $6 million out. Then a hundred validators agreed to stop making blocks — and the argument about what a blockchain is for started over.
Cronos, the blockchain attached to Crypto.com, stopped producing blocks on Sunday. Not because it crashed, and not because consensus broke. Its validators looked at what was draining out of Tectonic — the chain's largest lending protocol, holding close to half of all the DeFi value on the network — and decided that a chain which does nothing is better than a chain that keeps honouring the attacker's next transaction.
The Block first reported the incident on Aug 30, putting the affected sum at roughly $75 million on the estimate of on-chain researcher Weilin Li. Cronos confirmed it in a single sentence: "We identified an exploit in Tectonic. The Cronos Network has been halted and we'll provide updates here." Tectonic told users not to touch the protocol — "we are aware of an incident affecting Tectonic and our team is actively investigating" — and Crypto.com chief executive Kris Marszalek said the exchange itself was untouched: "Crypto.com app and exchange were not affected and are operating as usual. All funds are safe."
That last sentence is doing a lot of work, and we will come back to it.
The attack was not clever. It did not need to be.
Tectonic is a money market: deposit an asset, borrow against it. Like every money market, it lives or dies on one continuously asked question — what is this collateral worth right now? And like a great many of them, it accepted its own governance token as an answer.
TONIC is not a liquid asset. CryptoTicker puts its trading liquidity at around $1.34 million against daily volume of roughly $11,000. A token that trades eleven thousand dollars a day is not a price; it is a suggestion. The attacker paid the suggestion.
Per Li's reconstruction, relayed by The Block, TONIC was driven to roughly a hundred times its price inside about twenty minutes, after which the inflated holding was posted as collateral and real assets were borrowed against it. Tectonic's published parameters give TONIC a 20% collateral factor — you may borrow up to a fifth of what your deposited TONIC is deemed to be worth — which means every dollar of fake price bought twenty cents of genuine credit. The mechanism, Li noted, is the one Mango Markets was taken apart with in 2022. Four years is a long time for an industry to keep losing to the same move.
The transaction-level view is where it stops being abstract. Coinpedia's accounting has the attacker opening with a deliberately tiny probe — 3,091 TONIC deposited and 3,697 TONIC borrowed in the same block — before the oracle price jumped 6.46x in a single block fourteen seconds later. What followed was not subtle: $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH and 39.61 million CRO out of the pools, leaving roughly $1.73 million behind and $32.6 million in bad debt on the books. The whole sequence ran about 65 minutes.
Nobody agrees on the number, and you should be told that
Four figures are circulating and they are not four reports of the same measurement. Li's estimate, the one most outlets led with, is around $75 million and describes what the attacker actually retained. Coinpedia and CryptoTicker both put total outflow from the pools at about $119.5 million — gross, before you subtract what the attacker put in and what got clawed back through liquidation. Separately, on-chain analyst Awoo, cited by Crypto Briefing, describes roughly $120 million leaving in a single transaction, against about $5.6 million of the attacker's own money staked into the setup, plus around $2 million taken by copycats who spotted the mispricing and piled in.
The two accounts also disagree on the setup. Awoo describes about 16 trillion TONIC bought across three VVS pools for roughly $600,000, moving the price about 40%, then deposited alongside $5 million in USDC. Li's figure for the attack position is about 364.6 trillion TONIC — which, as The Block observed, would need to be valued near $375 million to support $75 million of borrowing at a 20% collateral factor. Those may yet reconcile; a position can be larger than a day's purchases. Nobody has reconciled them, and Tectonic has confirmed neither the size nor the root cause.
Note what is missing from the disagreement: none of it comes from Tectonic or Cronos. Every number in circulation is a stranger's reconstruction of a public ledger — the ordinary state of affairs on day one, but worth saying plainly rather than laundering an estimate into a fact by repetition.
Six days, three collateral manipulations, one escalating idea
The stop button, and what it costs to have one
Here is the part that separates this from every other collateral-manipulation story of the past week. Cronos runs Tendermint consensus with an active validator set capped at 100. As CryptoTicker puts it, with a hundred known operators an agreement can be organised within a few minutes — and it was. Only about $6 million had reached Ethereum across a bridge before block production stopped. Roughly $60 million sat frozen where it was, inside a chain that had ceased to exist in any operational sense.
Measured against the attacker, this worked. Measured against everyone else, be precise about what happened: every user of Cronos, every position on every unrelated protocol, every pending transaction from someone who had never heard of Tectonic, was stopped along with the theft. That is not a side effect of the remedy. It is the remedy.
And the property that made it possible is not an emergency measure that gets put away afterwards. A validator set of a hundred permissioned operators is the standing architecture of the chain. CryptoTicker's framing is the honest one: speed and the ability to act, traded against unstoppability — which is precisely why Bitcoin cannot be halted and Cronos can. You do not get to hold the stop lever only on the days you like the reason.
Whose loss is it
Return to Marszalek's sentence. Crypto.com's app and exchange were not affected; funds there are safe. Both statements appear to be true, and neither is about the people who are out of pocket. Tectonic held roughly $121.6 million — about 46% of all DeFi value on Cronos, per TFTC's read of DefiLlama's figures — against $82.7 million in active loans. TFTC's summary of the position is blunt and, on the record so far, accurate: the Cronos brand absorbed no loss, and the people who trusted the ecosystem's lending layer absorbed all of it.
As of publication there is no restart time, no postmortem, no announced plan for the attacker's frozen balance, and no commitment to make depositors whole. Those four blanks are the entire story from here. The frozen $60 million gets recovered only if somebody decides, on the record, to reach into a stopped chain and move somebody else's balance — a governance act, not a technical one, and it will need a name attached to it.
The Take
The exploit is the boring part. Listing your own thinly traded governance token as collateral against real bitcoin and stablecoins is a decision, made by people, in advance, and it is the same decision Moonwell made three days earlier with MAMO and paid $8.7 million for. Nobody needs another audit to catch this; they need someone empowered to say no to the asset list. What is genuinely new here is the second act. Cronos had a stop button, used it well, and saved roughly ten times what it lost — and in doing so demonstrated for anyone still confused that its liveness runs through a hundred known parties who can be reached on a Sunday. That is a legitimate design. It is not the design most of its users think they are holding. The bill for the stop button does not come due today; it comes due the first time the same hundred operators are asked to stop the chain for a reason nobody likes.