Cronos stoppet hele blokkjeden sin for å stoppe en utnyttelse på 75 millioner dollar

Cronos, the layer-1 chain built by Crypto.com, stopped producing blocks on Sunday, August 30. An attacker had just drained tens of millions of dollars from Tectonic, the network's largest lending protocol, and validators pulled the plug on the whole chain to stop the bleeding. Two days later, the exploit itself is almost the smaller of two stories. The bigger one is what it means that a "decentralized" blockchain can be switched off.

Cronos confirmed the incident on X, saying it had identified an exploit in Tectonic and halted the network while it investigated. Tectonic, which held roughly $121.7 million in deposits and $82.7 million in loans before the attack, close to half of everything locked in Cronos DeFi, told users to stay away from the protocol until it could confirm things were safe. By Monday, DefiLlama's dashboard showed Tectonic's total value locked had collapsed to around $3 million.

How The Attacker Did It?

The mechanism wasn't a broken smart contract. It was a mispriced risk parameter. On-chain researcher Weilin Li laid out the sequence in an X thread: TONIC, Tectonic's own governance token, traded with only about $1.34 million in liquidity and roughly $11,000 a day in volume, and yet the protocol still let people borrow against it at a 20% collateral factor. In roughly 20 minutes, the attacker pumped TONIC's price around 100x, deposited the inflated tokens as collateral, and borrowed real assets against a number the market never actually agreed to.

It's a playbook crypto has seen before. Li flagged the pattern as a "Mango-market style" pump-and-borrow, a nod to the roughly $100 million Mango Markets exploit from October 2022, and noted this was the third version of the same trick he'd tracked recently, after an $8.7 million hit on Moonwell's MAMO market and a separate reUSD/Pendle incident. Illiquid governance tokens keep getting listed as collateral, and attackers keep noticing before the protocols do.

Nobody Agrees On The Exact Number

Li's estimate moved twice: roughly $66 million at first, then closer to $75 million once he traced a second attacker-linked wallet holding about $8 million more. PeckShield landed independently near $74 million. A third researcher going by Hajedan took a different approach entirely, adding up gross borrowing across Tectonic's 16 markets and arriving at $124,963,890, of which he calculated 99.91% belonged to the attacker; he traced about $110.5 million of that still sitting on Cronos and roughly $7.8 million he couldn't place. Neither Cronos nor Tectonic has published an official loss figure.

None of these numbers actually contradict each other. They're measuring different things: net funds moved, gross borrowing, wallets attributed so far. Worth keeping in mind next time a headline picks one figure and presents it as settled fact.

What is fairly settled is where the money sits. Lookonchain traced about $6.29 million bridged to Ethereum and swapped into 2,592 ETH before the chain froze. The rest, somewhere between $60 million and $69 million depending on which tracker you trust, never made it off Cronos.

The Halt Is The Part People Are Actually Arguing About

Cronos runs on a Tendermint-based Cosmos SDK chain with a validator set capped at 100, small enough to coordinate an emergency stop within minutes. That's exactly what happened, and it's also exactly what's dividing the community now. One Cronos user posting as TurtleonCro put it about as fairly as anyone: the pause genuinely protected people from further loss, and it also proved that a small group of validators can freeze every wallet on the chain, whether or not that wallet ever touched Tectonic. Both things are true, and neither cancels the other out. A smaller, louder contingent has gone further, arguing this shouldn't even be called a hack, since the attacker didn't break any code, just followed the protocol's own published rules to their logical, ugly conclusion.

Crypto.com CEO Kris Marszalek addressed the incident on X the same day, explaining that the exchange's app and centralized platform were untouched and that a full postmortem would follow. "All funds are safe," he wrote, a claim worth separating from the chain-level freeze: Cronos and Crypto.com's exchange are different systems, and the halt never touched exchange balances.

Back Online, Questions Still Open

Validators restored block production at 23:49 UTC that same night, rolling the chain's state back to a snapshot taken before the exploit and resuming from block 90,896,189. Node operators were told to update to v1.7.8 and pull the published mainnet snapshots. Cronos called the rollback and halt a validator-consensus emergency action taken to protect users, and said a full postmortem was coming.

As of this writing, that postmortem hasn't landed, and neither has any compensation plan for Tectonic depositors. Roughly $32.6 million in bad debt reportedly remains inside the protocol, on top of about $8.71 million in liquidations triggered during the attack itself. CRO dropped as much as 10% intraday on the news, trading near $0.055 to $0.056, on a token that was already sliding into the weekend.

Context That Matters Here

2026 has not been kind to DeFi lending. Industry trackers count 67 lending-protocol exploits among 267 total DeFi incidents this year, pushing sector losses past $1.26 billion. Tectonic's collapse fits a pattern that keeps repeating: the exploit rarely starts with a broken contract. It starts with a collateral parameter nobody stress-tested against a token nobody was really trading.