Cronos halted its blockchain on Sunday after an exploit hit Tectonic, which happens to be its largest lending protocol. Experts estimated that roughly $75 million in assets were affected.

So far, no timeline has been provided for when the network will resume. The blockchain has also not said what will happen to the assets linked to the attacker after the chain is restarted.

Third Mango-Style DeFi Attack?

Crypto.com CEO Kris Marszalek confirmed the security breach and said that the Cronos team was investigating the incident. The Cronos app and exchange were not affected and continued operating as usual, and Marszalek asserted that all funds were safe.

On-chain tracking platform LookonChain reported that the attacker was only able to bridge $6.29 million to Ethereum. These funds were swapped for 2,592 ETH when the network was halted. As a result, the remaining $68.7 million is stuck on the Cronos Network.

Meanwhile, researcher Weilin Li said the attack was linked to Tectonic’s TONIC governance token, which has a 20% collateral factor despite having very thin liquidity. According to Li, the attacker carried out a Mango Markets-style pump-and-borrow price manipulation attack, which caused TONIC’s price to surge 100-fold within 20 minutes.

Similar price-manipulation attacks have also affected other DeFi platforms recently. For instance, Moonwell, a lending protocol on the Base network, lost over $8 million last week after an attacker manipulated the collateral price of MAMO, a small-cap token with thin liquidity. In response, Moonwell cut borrow caps for all Core Markets on Base to 1 wei, which effectively stopped new borrowing across the deployment. It also reduced supply caps for MAMO and WELL to 1 wei, while leaving other supply caps unchanged.

Another recent case involved a low-liquidity Pendle market, where price manipulation led to about $36 million in liquidations of leveraged PT-reUSD positions on Morpho.

Aftermath

Tectonic’s locked assets have dropped sharply following the exploit. According to the latest stats by DefiLlama, the lending protocol held around $121 million on August 29.

Two days later, that figure had fallen to roughly $3 million.

Source: CryptoPotato