Cronos halted its blockchain on Sunday after identifying an exploit involving the decentralized lending protocol Tectonic, in an incident that researcher Weilin Li estimated at roughly $75 million. At the time of publication, most of the affected funds were still believed to be on the Cronos network.

Cronos said it had detected an exploit in Tectonic and paused the network while it worked on the issue. Tectonic also warned users not to interact with the protocol during its investigation. Neither project had confirmed the cause of the exploit or the size of any losses, and no timeline for restarting the chain had been announced.

Researcher outlines pump-and-borrow scenario

Li said the attacker appears to have taken advantage of TONIC’s 20% collateral factor along with limited market liquidity. According to his account, the attacker drove the governance token’s price up by around 100 times in roughly 20 minutes and then borrowed other assets against the inflated collateral.

He characterized the incident as a “Mango-market style” pump-and-borrow attack. Li’s initial estimate put the amount affected at about $66 million. He later said the attacker had bridged roughly $6 million to Ethereum before the network halt, leaving about $60 million on Cronos. After identifying another address he linked to the attacker with around $8 million, Li revised the total to about $75 million.

Cronos and Tectonic pause activity

The network halt came after Cronos said it had identified the exploit affecting Tectonic. Tectonic issued its own warning, telling users not to interact with the protocol while the matter was under review.

As of publication, neither Cronos nor Tectonic had stated what specifically caused the exploit. They also had not said whether any onchain restrictions would be placed on the addresses tied to the attack.

Crypto.com says core platforms were unaffected

Crypto.com CEO Kris Marszalek said the company’s app and exchange were not impacted by the incident and were continuing to operate normally. He also said customer funds on those platforms were safe.

His statement drew a distinction between the halted Cronos blockchain and Crypto.com’s centralized services, which he said remained unaffected during the response to the exploit.

What remains unresolved

Several major questions were still open at the time of reporting. Cronos and Tectonic had not said whether they planned to recover assets, compensate affected users or otherwise respond to losses tied to the exploit.

The next confirmed step was further communication from the teams. Cronos said updates would follow, while Tectonic continued its investigation and maintained its warning for users to avoid interacting with the protocol.

Source: cointelegraph.com