# Cronos Stopped Producing Blocks After an Attacker Borrowed $75 Million From Tectonic

The attacker pushed a token with roughly $11,000 of daily volume up about 100-fold in 20 minutes, and only about $6 million left the network before validators froze the chain.

- Published: 2026-09-01T05:55:37.258Z
- Canonical: https://polylog.news/crypto/2026-09-01/cronos-stopped-producing-blocks-after-an-attacker-borrowed-7
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs (Tectonic proof-of-concept)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/063b8d9713abbc1e1484a34398c30b18e86b293c), [DeFiHackLabs (Tectonic proof-of-concept, merge)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/1433a30978e7f3eb2d46d4ecdd6d601615660ca0), [CryptoSlate](https://cryptoslate.com/ontology-halts-mainnet-transactions-as-technical-team-investigates-potential-security-issue/)

An attacker borrowed roughly $75 million out of Tectonic, the main lending market on the Crypto.com-affiliated Cronos network, and the network's validators responded by halting the chain entirely before restarting it, [CoinDesk reported](https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic). Security researchers at DeFiHackLabs have since published a runnable [proof-of-concept](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/063b8d9713abbc1e1484a34398c30b18e86b293c) reproducing the attack, which they classify as a Mango Markets-style collateral price manipulation.

The method was cheap and well documented. TONIC, Tectonic's own token, carried about $1.34 million of liquidity and roughly $11,000 of daily trading volume. The attacker raised its price about 100-fold in around 20 minutes, deposited the repriced tokens as collateral at a 20% collateral factor, and borrowed harder assets against them. No contract was tricked into breaking its rules. The lending market read a price that a real market had produced, and lent against it. TRM Labs, which tracks illicit on-chain activity, [says the number of price-manipulation attacks has reached an all-time high](https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic) and puts the amount taken from Tectonic at $75 million.

Because Cronos stopped, most of the proceeds never left. Reporting on the incident puts the amount successfully moved out at roughly $6 million in ether, with the rest stranded on a network that was no longer settling transactions. Tectonic's total value locked fell from about $121.7 million on Aug. 26 to roughly $3 million.

A day later, Ontology's core team [stopped block production on its own mainnet](https://cryptoslate.com/ontology-halts-mainnet-transactions-as-technical-team-investigates-potential-security-issue/) after a routine daily check flagged a potential security issue. The last block stood at 20,770,893, the team said no incident or asset loss had been confirmed, and it set no restart time. Bithumb and Upbit suspended deposits and withdrawals for ONT, ONG and MBL while the review ran.

Two chains used the same emergency measure within 48 hours. Halting limits losses, and it also settles a longstanding question. On both networks, a small enough set of coordinated operators can stop settlement for everyone. That is a protection for depositors and a problem for anyone who assumed the ledger would keep recording transactions no matter what happened.

## What this means

Lenders that accept their own low-liquidity governance token as collateral convert a thin order book into a borrowing facility, and the loss lands on depositors of the assets that were borrowed away, not on the token holders who benefited from the pump. The second exposure is settlement risk at the chain level: users of Cronos and Ontology could not move any asset while the halts ran, so exchanges suspended deposits and withdrawals and holders lost the ability to exit at any price. Both events push the audit perimeter outward from contract code to listing decisions, collateral factors and the validator coordination that can stop a network.

## What to watch

- Whether Tectonic or Cronos claws back any of the stranded borrowings, since a recovery would show that a chain halt can effectively reverse a theft and invite more networks to use the same tool.
- Whether other lending markets cut or remove collateral factors on their own low-liquidity tokens, which is the cheapest fix available and a direct signal of how seriously operators take this attack class.
- Ontology's restart and its post-mortem, which will show whether the pause prevented a real loss or was a precaution taken with no attacker present.