By 
On Sunday, someone drained an estimated $75 million from Tectonic, the largest lending protocol on Cronos, the blockchain built by Crypto.com. What happened next was more unusual than the theft itself: Cronos halted its entire blockchain, freezing every transaction on the network to stop the attacker from getting away with the money. It mostly worked, only about $6 million reached Ethereum before the chain went dark. But the whole episode is a lesson in two directions at once.
Start with the attack, because it is depressingly familiar. Tectonic accepted its own governance token, TONIC, as collateral, even though TONIC is thinly traded, with barely $1.3 million of liquidity. With so little depth, a modest amount of money can move the price enormously. According to onchain researcher Weilin Li, whose figures Cronos and Tectonic have not yet confirmed, the attacker pumped TONIC roughly 100-fold in about 20 minutes, deposited the suddenly “valuable” tokens as collateral, and borrowed real assets against them before the inflated price could collapse.
The oldest trick in DeFi, again
If that sounds like something you have heard before, it is. This is the same manipulation that drained over $100 million from Mango Markets back in 2022, and it is the third such attack in barely a week, after similar hits on Moonwell and a Pendle market. The vulnerability is well understood: a lending protocol that accepts an illiquid token as collateral is trusting a price that almost anyone with enough capital can fake. Tectonic’s own documentation even warned that low-liquidity assets are prone to this. It accepted TONIC as collateral anyway. The industry keeps relearning a lesson it wrote down years ago.
The uncomfortable part of the rescue
Now the response, which is where it gets interesting. Cronos’s validators stopped the whole chain within minutes, and that quick freeze trapped most of the stolen funds, tens of millions of dollars, on the network before they could escape. As a piece of damage control, it was effective. As a statement about the technology, it was awkward. A blockchain is supposed to be decentralized and unstoppable; the fact that Cronos could be paused on command shows it is centralized enough for a small group to hit the brakes. That saved the money here. It also means the same power exists on any ordinary day.
Crypto.com’s chief executive, Kris Marszalek, was quick to note that the exchange and its app were untouched and that its security team is helping. The brand, in other words, is fine. Tectonic’s depositors are another matter. As of now there is no timetable to restart the chain, no confirmed recovery plan, and no promise that the people whose money was borrowed against fake collateral will be made whole. Their funds are frozen alongside the attacker’s, in limbo.
So was halting the chain the right call? Given the alternative of watching $75 million vanish, almost certainly yes, and Cronos deserves credit for acting fast. But the episode captures the central tension of this corner of crypto perfectly. The same centralization that let Cronos claw back the loot is the thing that makes “decentralized finance” a stretch, and the same shortcut that made Tectonic convenient made it robbable. A frozen heist is a good outcome. Needing to freeze the whole system to get it is the uncomfortable part.
Comments