Tectonic (TONIC collateral) hack — August 2026

Cronos, the Crypto.com-linked network, halted its entire blockchain on 30 August 2026 after an attacker drained Tectonic, its largest lending protocol.

No contract was broken. TONIC, Tectonic's own token, carried a 20% collateral factor and traded thinly enough that the attacker could raise its price roughly a hundredfold inside twenty minutes. About ten minutes later a single transaction borrowed $120.4m across nine Tectonic markets against the inflated collateral, which is the figure in Cronos's own post-mortem. The withdrawals covered roughly $54.32m in USDC, $44.87m in USDT, 95.36 WBTC, 1,861 WETH and 39.61m CRO, alongside smaller tokens. Before the attack Tectonic held about $121.7m in total value locked and $82.7m in active loans.

What happened next is the part worth recording. Cronos did not negotiate and did not wait. The malicious activity was identified about 36 minutes in; validators halted the chain at block 90,907,150, restored its state to block 90,896,188, the last block before the attack, and discarded 10,961 blocks, about one hour and fifty-four minutes of history. Production resumed from block 90,896,189 at 23:49:01 UTC on 30 August, about eleven hours after the attack began. Cronos called it a validator-consensus emergency action to protect users. The theft was erased from the ledger along with every other transaction anyone had made in that window, which is the cost of the remedy and the reason it remains contested: the balances of users who had nothing to do with the attack were rewound too, and open positions on live applications were repriced when trading resumed.

The rollback reversed about $111.2m, which is recorded as recovered rather than netted off the headline. It could not reach the $9.19m, 7.6% of the total, that had already left the network before the halt. Earlier reporting identified 2,592.2152 ETH, about $6.29m, bridged to Ethereum in that window, part of which the attacker later began moving on to Bitcoin; the post-mortem's larger figure covers everything that got out. It does not name the attacker or say who will absorb the unrecovered amount.

The figure first recorded here was $75m, an on-chain researcher's same-day estimate of attacker-controlled assets. It was replaced on 10 September by the post-mortem's $120.4m, which matches CertiK's earlier impact figure; Foresight News had counted $119.5m. The DefiLlama dataset lists $124.47m, which neither Cronos nor any publisher supports, and it is not followed here.