Cronos Network Paused After $70M+ Exploit of Tectonic Money Market

The Cronos layer‑1 blockchain, operated by Crypto.com, announced that it has frozen all block production while a investigation into a massive exploit of the Tectonic money‑market protocol is underway.

What happened

According to the network’s latest update, an attacker spent about $600,000 to purchase a large amount of TONIC tokens across three thin liquidity pools, pushing the token’s price up roughly 40‑fold. The inflated price was then used as collateral to borrow nearly $120 million in stablecoins, Bitcoin, Ether and CRO. The exploit resulted in a loss of more than $70 million from Tectonic.

Validator response

Cronos validators voluntarily halted block production, which locked roughly $60 million of the stolen assets on‑chain. The pause prevents further transfers of the illicit funds but creates a dilemma: whether to resume the chain and allow the remaining assets to move, or to roll back the blockchain to a pre‑attack state.

Stakeholder statements

• Crypto.com CEO Kris Marszalek confirmed the exchange is assisting the investigation and said user funds on Crypto.com remain safe.
• Glyde co‑founder Jeremy posted that only about $6 million of the stolen funds has left the network so far.
• Tectonic, the largest money‑market on Cronos, warned users to pause activity until security is restored.

Technical analysis

Industry observer Awoo noted that the attack exploited price‑oracle manipulation rather than a code vulnerability. By buying a massive amount of TONIC in low‑liquidity pools, the attacker created a false market price that the protocol accepted as valid collateral.

Next steps

Validators must decide between restarting the chain, which could let the remaining stolen assets be transferred, or executing a chain‑rollback to reverse the exploit. The decision will shape the future governance and resilience of the Cronos network.