Crypto.com's Cronos Halts Entire Blockchain After $75M Tectonic Exploit

In brief

• Cronos stopped producing blocks on Sunday after an exploit at Tectonic, the largest lending protocol on the network.
• An onchain researcher estimated the loss at about $75 million, with roughly $6 million bridged out before the halt.
• The chain was still halted on Monday, Cronos said, though Crypto.com's app and exchange are unaffected.

Cronos switched off its entire blockchain on Sunday to contain an attack on DeFi lending protocol Tectonic, freezing every position on the network in the process.

Tectonic enables users to deposit crypto for others to borrow against posted collateral, earning interest in return. It was the first such protocol to launch on Cronos and remains by far the largest, holding close to half of all the capital deposited across the network's DeFi apps. The next-biggest lender on the chain, Mimas Finance, holds about $30,000, according to DefiLlama.

In a tweet, Cronos noted that it had "identified an exploit" in Tectonic, adding that it had halted the Cronos Network and would provide updates. A day later it confirmed the chain was still down, saying it was investigating "with support from security teams across the industry."

Onchain researcher Weilin Li described it as a "Mango-market style pump-and-borrow price manipulation attack," a reference to the $100 million exploit of Mango Markets in October 2022. TONIC's price surged 100-fold within 20 minutes, he said, before the attacker borrowed against it.