The Cronos blockchain has restarted following a Tectonic TONIC price manipulation attack that allowed a threat actor to borrow $74 million in assets from the decentralised finance (DeFi) lending protocol. Cronos confirmed the network is ‘producing blocks again as of 2026-08-30 23:49:01 UTC, starting from block 90,896,189.’
Tectonic is a DeFi lending app that runs on Cronos, an Ethereum-like blockchain network associated with Crypto.com. Before the incident, Tectonic was Cronos’ largest lending protocol, holding $122 million in total value locked. After the exploit, that figure collapsed to just under $3 million, according to DeFiLlama.
How the Tectonic TONIC price manipulation unfolded
The attack centred on Tectonic’s native TONIC token, which carried some glaring structural vulnerabilities heading into the assault. According to KuCoin, TONIC had very low liquidity of around $1.34 million and a daily trading volume of roughly $11,000 before the attack. That shallow market made the token trivially easy to move. Tectonic had also accepted TONIC as collateral with a 20% collateral factor, meaning a manipulated price could unlock a disproportionate volume of borrowed assets.
The attacker exploited exactly that combination. According to Cryptonomist, the threat actor used CoinGecko-tracked trading activity to push TONIC’s price up by roughly 300-fold in just 20 minutes. The inflated TONIC was then deposited as collateral, and the attacker borrowed real assets against that manufactured valuation. The original story describes the artificial inflation as 100 times, the two sourced figures differ, and neither has been reconciled publicly.
TRM Labs noted that TONIC had traded approximately $305,000 in the week before the attack, a detail that underscores just how thin the token’s genuine market activity was relative to the size of the funds the attacker managed to unlock. A token with a weekly traded volume measured in the hundreds of thousands of dollars is not built to withstand a manipulation attempt at this scale.
Most of the stolen funds remained stuck on Cronos
For all the headline size of the borrow, the attacker’s actual take was considerably smaller. Blockchain security and data analytics company PeckShield assessed that the threat actor managed to extract only roughly $6 million worth of Ethereum, with the remainder of the funds ‘stuck’ on Cronos. The chain halt, triggered as a validator-consensus emergency action, appears to have been the primary reason so much stayed frozen in place.
Cronos acted quickly once the exploit was detected, halting the blockchain and freezing all transactions in progress at the time. The chain state was subsequently restored to the point before the attack took place. ‘This was a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol,’ Cronos stated. The blockchain is currently being closely monitored for stability, protocol compatibility, and other issues.
Tectonic, for its part, had already advised users not to interact with the protocol while the investigation was under way. The platform said it would publish a post-mortem report with further details about the exploit.
The Tectonic TONIC price manipulation is a textbook example of what can happen when a lending protocol accepts a token with genuinely thin liquidity as collateral, regardless of its nominal market cap. The 20% collateral factor did nothing to protect against a price that could be moved this dramatically, this quickly. Whether Tectonic’s post-mortem report addresses those parameters directly will be the first thing observers look for when it is published.
