Cronos suspended block production across the entire blockchain on Sunday to control the spread of risks after the attack on its lending protocol Tectonic. This pause froze lending, transactions, profit distribution, and automated trading positions on the network. Cronos stated on Monday that the blockchain is still in a suspended state, and they are working with multiple security teams to investigate the incident. Crypto.com claimed that its App is operating normally, and customer funds have not been affected.

TONIC Assets are lent out after the price has been pulled up.

Tectonic is the largest lending protocol on Cronos. Users can deposit crypto assets for others to use as collateral for loans and receive interest returns. According to DefiLlama data, before the incident, the deposit scale of this protocol was approximately 121.7 million US dollars, with active loans amounting to about 82.7 million US dollars, accounting for nearly half of the total locked-up funds on Cronos DeFi.

On-chain researcher Weilin Li described this incident as a "lending after price manipulation" attack similar to that of Mango Markets. According to him, the attackers first drove up the price of TONIC in a short period of time, and then used the elevated token price as collateral to borrow other assets. Li stated that the price of TONIC once increased by about 100 times within 20 minutes.

Mortgage parameters do not match liquidity.

Li believes that the core of the issue lies in the fact that Tectonic has set a 20% collateral ratio for its governance token TONIC, yet the liquidity of this token is very low. According to them, the liquidity of TONIC is only about $1.34 million, and a small amount of capital is sufficient to significantly drive up the price, allowing attackers to borrow a large amount of assets based on a valuation that is difficult to realize in the real market.

Li Initially, the estimated profit from the attack was around 66 million US dollars. However, after discovering another account controlled by the attackers that held approximately 8 million US dollars in assets, the loss was revised upward to around 75 million US dollars. The estimate provided by the security company PeckShield is close to this, at around 74 million US dollars.

• Li The estimated loss after correction is about 75 million US dollars.
• PeckShield Estimated losses are around $74 million.
• Approximately $6 million was transferred across chains to Ethereum before the chain halt.

After the chain was halted, most of the funds remained in Cronos.

Cronos Choosing to directly pause the entire chain has indeed restricted further capital outflows in the short term. Li It is stated that only about 6 million US dollars were transferred to Ethereum before the chain was paused, while the remaining approximately 60 million US dollars are still stuck on Cronos. PeckShield It is also mentioned that the attackers were unable to transfer most of the funds before the chain was paused.

DefiLlama Data shows that the largest decentralized exchange on Cronos added nearly $61 million in deposits within the same 24-hour period, which roughly coincides with reports that some funds were transferred to the DEX pool. At the same time, the scale of DeFi funds across the entire Cronos chain has significantly declined.

This incident also revealed the cost of a chain halt. Since Cronos uses a set of validators with a limit of 100 validators, the coordination for pausing was relatively faster, but ordinary users on the network who were not participating in Tectonic were also affected, resulting in the forced interruption of all outstanding loans, transactions, and automated strategies.

This is not the first time such an incident has occurred in the history of the protocol.

DefiLlama records show that Tectonic has experienced at least two security incidents before, which occurred in February 2024 and November 2024 respectively. The incident in February 2024 resulted in a loss of approximately $250,000. This incident has been classified as a predictor manipulation attack carried out through spot price manipulation.

As of now, neither Cronos nor Tectonic has provided a timeline for recovery or confirmed the final amount of losses, nor have they stated whether compensation will be given to depositing users.