Cronos Network has halted block production after an exploit targeting Tectonic, its largest lending protocol, placed an estimated $119.5 million in assets at risk, according to on-chain analysis. The incident involved the manipulation of Tectonic’s governance token, TONIC, which sharply increased the value of collateral and enabled the attacker to obtain substantially larger loans.
Tectonic has not yet confirmed the final financial impact of the attack. The protocol has launched an investigation and advised users to avoid interacting with the platform until its security has been established.
The scale of the incident remains uncertain because the $119.5 million figure represents an on-chain estimate rather than a confirmed loss. Analysis based on a Cronos archive node indicated that the attacker drained approximately $119.5 million from lending pools over a period of about 65 minutes.
The same analysis found that only around $1.73 million remained across the affected markets following the activity. It also identified 752 liquidations involving approximately $8.71 million in seized assets, while about $32.6 million in bad debt was reportedly left in the protocol.
TONIC Oracle Manipulation Expanded Borrowing Capacity
The attack appeared to center on an abrupt manipulation of the TONIC token price used by the lending protocol. On-chain data indicated that the attacker initially deposited 3,091 TONIC tokens and borrowed 3,697 TONIC within the same block.
About 14 seconds later, the TONIC oracle price increased by roughly 6.46 times in a single block. The sudden price movement significantly raised the reported value of the attacker’s collateral, allowing the attacker to access approximately $125.6 million in borrowing capacity.
The exploit demonstrates how manipulation of a lending protocol’s price data can rapidly inflate collateral values and enable borrowing far beyond what the underlying assets would normally support.
The attacker subsequently withdrew a wide range of assets from the lending markets. These included approximately $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH, and 39.61 million CRO, in addition to several other tokens.
According to the on-chain analysis, around $75.7 million of the assets were transferred to an external wallet, while another $43.7 million was directed to a contract address. The movement of those funds and their current status remain part of the investigation.
We are aware of an incident affecting Tectonic and our team is actively investigating.
As a precaution, please do not interact with the protocol until we confirm it is safe to do so.
We will post a verified update here as soon as we have one.
— Tectonic.cro (@TectonicFi) August 30, 2026
Cronos Blockchain Halted Following Exploit
Cronos confirmed that it had identified an exploit involving Tectonic and suspended the network while security teams examined the incident. Crypto.com’s security team was also involved in the investigation.
Halting the Cronos blockchain has limited the attacker’s ability to move or further exploit assets that remain on the network, potentially containing additional losses while investigators assess the incident.
There has been a security breach on a Cronos lending protocol Tectonic. Cronos team is investigating, with assistance from https://t.co/JNeHyErmqH security team. https://t.co/JNeHyErmqH app and exchange were not affected and are operating as usual. All funds are safe.
I will…
— Kris (@kris) August 30, 2026
Tectonic separately warned users against interacting with the protocol while the investigation continues. The precautionary measure is intended to prevent additional transactions from complicating the response or exposing users to further losses.
The incident has also raised questions about the resilience of decentralized lending systems that rely on token price oracles to determine collateral values and borrowing limits. A sudden distortion in an oracle price can have significant consequences when lending protocols automatically adjust borrowing capacity based on those valuations.
Crypto.com CEO Kris Marszalek said the exploit did not affect the company’s app or exchange operations and that customer funds held through those services remained safe.
For now, the estimated $119.5 million figure should not be treated as Tectonic’s confirmed loss. The final amount affected, the portion that can potentially be recovered, and the steps required to restore Cronos operations remain unresolved as the investigation proceeds.
Tectonic’s warning to users remains in effect, with further details expected as investigators complete their assessment of the exploit and affected lending markets.