NewsMV
← News·Markets · Digital AssetsMarkets

Cronos network halts as Tectonic exploit drains estimated $75 million via oracle manipulation

The Cronos network, the blockchain linked to Crypto.com, suspended operations after an attacker drained an estimated $75 million from Tectonic, a lending protocol built on the chain. The attack turned on TONIC…

NM
NewsMV Markets Desk
3 min read
30 August 2026Markets desk
Share this dispatch

Key takeaways

  • An attacker drained an estimated $75 million from Tectonic, a lending protocol on the Cronos blockchain linked to Crypto.com.
  • The Cronos network suspended operations after the exploit.
  • The attacker manipulated the price of TONIC, Tectonic's illiquid native token, then borrowed against the inflated collateral value from Tectonic's lending pool.
  • Li described the incident as a Mango Markets-style hack exploiting oracle-based pricing of illiquid tokens.
  • No timeline for chain resumption, and no reimbursement figure or timeline for depositor losses, has been confirmed.

The Cronos network, the blockchain linked to Crypto.com, suspended operations after an attacker drained an estimated $75 million from Tectonic, a lending protocol built on the chain. The attack turned on TONIC, Tectonic's illiquid native token, in what Li described as a Mango Markets-style hack. The next confirmable development is a formal statement from the Cronos or Tectonic teams on chain resumption and depositor losses.

Li's account of the mechanics: the attacker manipulated TONIC's price before borrowing against the inflated collateral value. Thin markets are easier to push and hold at an artificial level, and TONIC's illiquidity made it the workable piece. The borrowed funds came from Tectonic's lending pool, backed by collateral reflecting a manipulated price rather than a real one.

The Cronos halt leaves users with open questions. When block production resumes and whether depositors in Tectonic's pools recover funds are both unresolved. No reimbursement figure or timeline has been confirmed.

The Mango Markets comparison Li drew points to a known category of risk inside lending protocol design. Oracle-based pricing of illiquid tokens creates an exposure a well-resourced attacker can exploit directly. The post-mortem question is how TONIC's price feed was configured and what manipulation controls, if any, were in place.

Related reading

Categorycrypto

Filed via theblock.co

← Back to all dispatchesFront page →
Keep reading

More from the markets desk

Markets · Digital AssetsMarkets

Crypto ETF speed push draws resistance from Jane Street and Charles Schwab

The effort by crypto firms to get the SEC to move faster on cryptocurrency ETF reviews and allow confidential draft filings has opened a clear divide with two firms whose standing in ETF markets gives their objections…

NM
NewsMV Markets Desk
3 min read
Markets · Digital AssetsMarkets

Crypto projects spend hundreds of millions on token buybacks, but the value question is open

Crypto projects are collectively spending hundreds of millions of dollars to purchase their own tokens, a trend that has grown sharply. Whether that capital is building real, lasting value for holders, or simply making…

NM
NewsMV Markets Desk
3 min read
Markets · Digital AssetsMarkets

Normet opens technology centre in Finland to advance underground mining autonomy

A new technology centre in Pirkkala, Finland, is intended to accelerate Normet's work on autonomous and robotic systems for underground mining, built to expand the company's research, devel

NM
NewsMV Markets Desk
3 min read

Frequently asked

How did the attacker carry out the exploit?

According to Li, the attacker manipulated TONIC's price to inflate its collateral value, then borrowed funds from Tectonic's lending pool backed by that manipulated price rather than a real one.

Why was TONIC used in the attack?

TONIC is illiquid, and thin markets are easier to push and hold at an artificial price level, which made it the workable piece for the manipulation.

Will Tectonic depositors recover their funds?

It is unresolved; no reimbursement figure or timeline has been confirmed, and whether depositors recover funds remains an open question.

When will the Cronos network resume operations?

That is unconfirmed, as no timeline for when block production resumes has been announced.

What broader risk does this attack highlight?

It highlights the risk in lending protocol design of oracle-based pricing of illiquid tokens, which a well-resourced attacker can exploit directly, similar to the Mango Markets hack.