Crypto.com’s Cronos blockchain went completely offline Sunday following a sophisticated price manipulation attack on Tectonic, the network’s dominant lending protocol. The exploit drained approximately $75 million in what researchers say is the third major attack of its kind in recent weeks across multiple DeFi platforms.
According to reporting by Decrypt, the Cronos team identified the breach and immediately halted block production to prevent further asset movement. Only about $6 million of the stolen funds reached Ethereum before the network froze. The remaining $60 million sits trapped on a blockchain that hasn’t produced blocks since the incident.
How the Attack Unfolded
Onchain researcher Weilin Li described the incident as a textbook “Mango Markets-style” price manipulation attack, comparing it to the $100 million exploit that hit Mango Markets in October 2022. The mechanics were straightforward but devastating.
Tectonic assigned its own governance token, TONIC, a 20% collateral factor despite the token having minimal liquidity. With just $1.34 million in total liquidity, modest trading volumes can move the price dramatically. The attacker exploited this asymmetry by pushing TONIC’s price up 100-fold within 20 minutes, then borrowing massive amounts against the inflated collateral.
Security firm PeckShield validated the damage estimate at roughly $74 million. At the time of the exploit, Tectonic held $121.7 million in deposits and $82.7 million in active loans—roughly half of all capital deployed in Cronos DeFi applications.
The Nuclear Option: Shutting Down the Chain
Cronos’ response—halting the entire network—was extreme but effective from a containment perspective. The chain operates with just 100 validators, a small enough set to coordinate a near-instantaneous shutdown. This allowed the network to freeze every transaction in progress, trapping the attacker’s remaining proceeds on the inaccessible blockchain.
The tradeoff was brutal for legitimate users. Automated trading positions closed out. Loans froze mid-term. Pending transfers never arrived. Users who had never interacted with Tectonic found themselves locked out of their assets alongside those affected by the breach.
Crypto.com CEO Kris Marszalek reassured users that the exchange and mobile app remained operational and customer funds were safe. But for Cronos depositors, that distinction was meaningless—their DeFi holdings were offline indefinitely.
A Pattern Emerging in DeFi
This wasn’t Tectonic’s first security incident. The protocol suffered two earlier breaches classified as protocol logic failures—one in February 2024 costing $250,000 and another in November 2024. But Sunday’s attack was categorized differently: direct oracle manipulation through spot price manipulation.
The incident fits into a troubling trend. Li identified it as the third such price manipulation attack in recent weeks. Moonwell suffered an estimated $8.7 million loss when attackers manipulated the illiquid MAMO token. A separate attack on a Pendle reUSD market triggered approximately $36 million in liquidations on August 25.
All three attacks exploited the same vulnerability: lending protocols assigning disproportionately high collateral values to tokens with insufficient market liquidity.
What Happens Next
As of Monday, neither Cronos nor Tectonic had provided a restart timeline or confirmed whether depositors would be made whole. The 97.5% collapse in Cronos DeFi deposits over 30 days—from roughly $121.7 million to $3 million according to DefiLlama—signals how quickly confidence evaporates in the aftermath of exchange halts and unrecovered funds.
The frozen $60 million in attacker proceeds represents a hostage situation with no clear resolution. The attacker apparently attempted to obscure part of their haul by parking funds in Cronos’ largest decentralized exchange, suggesting they anticipated potential blacklisting once chain activity resumed.
For the broader DeFi ecosystem, the incident underscores a recurring architectural flaw: the gap between theoretical collateral values assigned by protocols and the actual liquidity available to sustain those prices in real market conditions.