The Cronos network has paused operations following an exploit targeting decentralized lending protocol TectonicFi, with early security estimates placing losses at roughly $75 million. The incident centered on alleged price manipulation involving the TONIC token, which was used to extract liquidity from lending pools before network activity was halted.
Blockchain intelligence firm AMLBot said the attacker drove TONIC’s price nearly 100 times higher before using the inflated asset as collateral to borrow against other pools. The manipulation reportedly enabled approximately $75 million to be drained from the protocol, although the subsequent Cronos halt prevented most of those assets from immediately leaving the network.
Project @TectonicFi on @CronosNetwork was exploited for ~$75M
Tracing shows the attacker bridged ~$6.5M to Ethereum via @RelayProtocol before Cronos halted the chain, freezing the remaining ~$60M in place on Cronos
On Ethereum, the attacker now holds ~2,592 ETH and ~182K USDC… pic.twitter.com/8e75QVvG0l
— AMLBot (@AMLBotHQ) August 31, 2026
Most Exploited Funds Remain on Cronos
Tracing data by AMLBot indicates that approximately $68.7 million remained on Cronos after operations were suspended. The network halt effectively prevented the majority of the exploited assets from being transferred elsewhere, giving security teams and ecosystem participants more time to assess the movement of funds.
The attacker nevertheless managed to bridge a portion of the proceeds to Ethereum before Cronos stopped processing activity. Roughly $6.5 million was transferred to Ethereum through Relay Protocol, where tracing data identified approximately 2,592 ETH and 182,000 USDC distributed across two addresses.
The Ethereum funds have since become a focal point for security monitoring. Reporting cited in the initial incident details described the exploit as a price-manipulation “pump-and-borrow” attack, while noting similarities to techniques commonly seen in rapid DeFi lending exploits. The defining mechanism appears to have been inflated collateral rather than a conventional lending position, allowing the attacker to borrow against an artificially elevated TONIC valuation.
Recovery Options Remain Unclear
The 182,000 USDC moved to Ethereum could represent one potential recovery avenue because the stablecoin can technically be frozen by its issuer, Circle. Whether any freeze or recovery action will actually occur has not been confirmed, and no finalized plan has been announced for recovering the remaining exploited liquidity.
Estimates for funds still contained within Cronos have varied between roughly $60 million and $68.7 million, while the amount successfully moved to Ethereum has been placed between approximately $6.4 million and $6.5 million. Those figures remain preliminary as investigators continue tracing the exploit, meaning the final accounting could change as additional transactions are reviewed.
At the time of the latest updates, Cronos remained paused while TectonicFi and network validators assessed the protocol and broader network state. Users were unable to interact normally with lending markets or transfer assets on-chain during the suspension, and no formal timeline for restoring operations or completing the recovery process had been confirmed.
