Cronos has restored block production after an estimated $75 million price-manipulation exploit hit Tectonic, the network’s largest lending protocol, on August 30. Security firm CertiK Alert tracked roughly $75 million across three addresses and urged users to avoid Tectonic while the incident was investigated. The attack turned manipulation of Tectonic’s thinly traded TONIC token into enough artificial collateral value to borrow substantially more liquid assets from the protocol.
Cronos validators responded by halting the entire network, preventing most exploit-linked assets from leaving the chain. Approximately $6 million reached Ethereum before block production stopped, while the rest remained on Cronos. The emergency halt contained most of the attacker’s proceeds, but it also suspended unrelated transactions and applications across the network.
We have seen a price manipulation exploit on @TectonicFi on Cronos.
~$75M is now at three addresses:https://t.co/ig7yiMgkSXhttps://t.co/DCaveqRRxghttps://t.co/ig7yiMgkSX
Please do not interact with it till safe.
Stay Vigilant!https://t.co/1KiEMjGtLZ
— CertiK Alert (@CertiKAlert) August 30, 2026
TONIC Price Manipulation Triggered the Attack
The attacker pushed TONIC’s price roughly 100 times higher in about 20 minutes before using the inflated tokens as collateral. TRM Labs found that TONIC had generated only about $305,000 in trading volume during the preceding week, while approximately $75 million was ultimately borrowed against the manipulated position. The mismatch between shallow market liquidity and available borrowing capacity created the core vulnerability exploited by the attacker.
Tectonic had approximately $121.7 million in total value locked and $82.7 million in active loans shortly before the incident. The protocol warned users not to interact with its contracts while investigators assessed the damage. The episode demonstrates how an illiquid collateral asset can expose an entire lending market when oracle pricing allows temporary market manipulation to support oversized borrowing.
Independent coverage from Bloomberg Law reported that blockchain security firm PeckShield estimated more than $74 million had been borrowed through the manipulated collateral, while at least $6 million escaped before validators froze activity. That external reporting broadly supports the scale of the incident while leaving the final loss dependent on the network’s subsequent recovery actions.
Cronos Rolls Back Chain State
Cronos subsequently chose a more aggressive recovery path than simply restarting from the halted state. Validators restored the blockchain to a snapshot from before the Tectonic exploit and resumed production at 23:49:01 UTC on August 30 from block 90,896,189. The rollback effectively reversed roughly $68.7 million of exploit-linked activity that had remained on Cronos, while assets already bridged to Ethereum were outside its reach.
Node operators were instructed to restart using Cronos v1.7.8 and updated mainnet snapshots. Cronos said the base network was back online but remained under observation, with some bridges, RPC providers, explorers and applications requiring additional time to recover. The network restart therefore resolved the chain-wide halt without immediately ending the broader Tectonic incident response.
Crypto.com CEO Kris Marszalek said the company’s exchange and app were not affected by the Tectonic breach. The exploit was confined to DeFi infrastructure on Cronos rather than Crypto.com’s centralized customer platform, although the emergency chain halt necessarily affected applications relying on Cronos settlement.
For lenders and DeFi operators, the incident leaves a broader risk-management lesson. Collateral limits must reflect executable market depth, not merely an oracle price, because a temporarily inflated valuation can become economically dangerous when a lending protocol allows large amounts of harder assets to be borrowed against it. Cronos has said a full postmortem will follow once network stability is confirmed.