Crypto.com-linked Cronos halts after Tectonic exploit estimated at $75 million

The Cronos network halted on Sunday after an exploit affected Tectonic, its largest lending protocol. Onchain researcher Weilin Li estimated that about $75 million in assets were affected. Cronos Network said it identified an exploit in Tectonic and halted the network. Tectonic said it was investigating the incident. Tectonic told users not to interact with the protocol until it confirmed that the protocol was safe. Tectonic had approximately $121.7 million in total value locked before the incident, according to DefiLlama data. Tectonic had about $82.7 million in active loans before the incident. Tectonic had not confirmed the amount affected or explained the cause. Li attributed the exploit to manipulation of TONIC, Tectonic's thinly traded governance token. Li said the attacker increased TONIC's price 100 times within 20 minutes. The attacker then used the inflated tokens as collateral to borrow other assets from Tectonic. Tectonic's published money-market parameters assign TONIC a 20% collateral factor. Li identified roughly 364.6 trillion TONIC tokens in the attack position. The tokens would need to be valued at about $375 million to support the estimated borrowing. The estimated borrowing totaled about $75 million. The tokens would need to be valued at roughly $0.00000103 each. That value was approximately 100 times TONIC's price near its pre-attack low, according to CoinGecko data. Li initially estimated that the attacker took about $66 million. Li later identified another attacker-controlled address containing roughly $8 million. Li said the attacker bridged around $6 million to Ethereum before Cronos halted. The estimate had not been independently confirmed by Tectonic or Cronos. Crypto.com CEO Kris Marsalek said the firm's app and exchange were not compromised. Marsalek said Crypto.com's security team was assisting Tectonic with the investigation. Crypto.com originally developed the Cronos network. Tectonic operates as Cronos's first independent decentralized finance lending protocol on the network. Cronos had not disclosed a plan to restart the network. Cronos had not explained what would happen to the attacker's assets when the chain resumes.