Fraudsters steal $6 million from Tectonic crypto platform after inflating token price
At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend.
The decentralized lending platform confirmed on Sunday morning that it was dealing with a security incident, and the public blockchain Cronos halted activity to prevent an outflow of stolen funds.
The fraudsters were able to jack up the price of Tectonic’s thinly traded coin to more than 100-times its original price in the span of 20 minutes. They then used the Tonic tokens, with their newly inflated price, as collateral in order to borrow assets against them — attempting to make off with an estimated $74 million, according to blockchain security firms.
While more than $6 million left the platform, about $68 million was stopped from leaving and is still on the Cronos blockchain.
Kris Marszalek, CEO of Crypto.com — the company behind Cronos — said they are assisting in the investigation and noted their platform was not affected by the incident. On Monday, Cronos explained that it is back online and told customers that it made the emergency decision to shut the platform down “to protect users from an exploit on the Tectonic protocol.”
“This was deemed necessary as it protected users from being exposed to this exploit,” Cronos CEO Ryan Wyatt said.
Crypto.com and Cronos did not respond to requests for comment about what will happen to the funds that were frozen on the platform. Blockchain security company TRM Labs claimed Cronos “restored” its system back to the state it was in before the attack, thus “reversing” the nearly $69 million that was still on the platform.
TRM Labs said the rollback was visible on the blockchain. It had no impact on the $6 million that had already left the platform, and it is unclear whether the company will negotiate with the hacker.
Tectonic said it plans to reopen in phases, initially allowing withdrawals while keeping borrowing and depositing activity paused. The company said it will release a full postmortem on the incident at a later date.
As of Monday, it was unclear who launched the attack against Tectonic.
Experts compared the incident to one that impacted cryptocurrency trading platform Mango Markets in 2022 — where a fraudster borrowed funds, artificially raised the price of a coin and then offloaded the funds, eventually pocketing the difference. The man behind that incident was eventually arrested and convicted of commodities fraud, commodities market manipulation, and wire fraud.
The attack on Tectonic comes days after a similar incident impacting the Moonwell platform involved losses of about $8.7 million worth of cryptocurrency.
Ari Redbord, global head of policy at TRM Labs, said the industry has seen an increase in market manipulation attacks, where an attacker moves the price of a token and then borrows against that inflated price.
"These are now one in eight crypto hacks, up from one in 17 in 2022, with 32 incidents so far this year,” Redbord said. “The vulnerability is in how protocols value collateral.”
References in this story
- Tectonic.cro (@TectonicFi) on X x.com We are aware of an incident affecting Tectonic and our team is actively investigating. As a precaution, please do not interact with the protocol until we confirm it is safe to do so. We will post a verified update here…
- Cronos Network (@CronosNetwork) on X x.com We identified an exploit in Tectonic. The Cronos Network has been halted and we'll provide updates here
- Weilin (William) Li (@hklst4r) on X x.com It seems @TectonicFi has been exploited for around $66M! The root cause is simple: TONIC, it's own governance token has a 20% collateral factor, with very thin liquidity. The attacker performed a Mango-market style…
- PeckShieldAlert (@PeckShieldAlert) on X x.com #PeckShieldAlert @TectonicFi was exploited for ~$74M total on the @CronosNetwork. In response, Cronos paused the entire chain. The attacker managed to bridge out only ~$6M to #Ethereum before the pause, leaving the…
- CertiK Alert (@CertiKAlert) on X x.com #CertiKInsight 🚨 We have seen a price manipulation exploit on @TectonicFi on Cronos. ~$75M is now at three addresses: https://t.co/ig7yiMgkSX https://t.co/DCaveqRRxg https://t.co/ig7yiMgkSX Please do not interact with…
- Crypto.com Canada: Buy, Sell & Trade Crypto with a Trusted App crypto.com Buy, sell, store, and trade over 400+ cryptocurrencies on Crypto.com, a secure and trusted crypto exchange platform in Canada.
- Kris (@kris) on X x.com There has been a security breach on a Cronos lending protocol Tectonic. Cronos team is investigating, with assistance from https://t.co/JNeHyErmqH security team. https://t.co/JNeHyErmqH app and exchange were not…
- Cronos Network (@CronosNetwork) on X x.com The Cronos Network is producing blocks again and is fully back online. The Cronos Network halted earlier today. This was a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol…
- Ryan Wyatt (@Fwiz) on X x.com The @CronosNetwork halted yesterday via validator consensus to protect users following the Tectonic exploit. This was deemed necessary as it protected users from being exposed to this exploit. The chain is back online…
- Number of Price-Manipulation Attacks Hits All-Time High as USD 75 Million Is Stolen From Tectonic | TRM Labs www.trmlabs.com Price-manipulation attacks hit an all-time high in 2026. An attacker took USD 75 million from Tectonic, and Cronos rolled back its chain to reverse it.
- Sweep (@0xSweep) on X x.com Someone borrowed $75 million against a token with $11,000 of daily trading volume, and the only way to stop him was switching an entire blockchain OFF The token is TONIC, the governance token of Tectonic, the biggest…
- Crypto trading platform Mango Markets drained of more than $100 million in flash loan attack therecord.media Cryptocurrency trading platform Mango Markets was robbed of more than $100 million on Tuesday night after a successful flash loan attack.
- DOJ arrests man behind brazen $100 million attack on Mango Markets therecord.media The DOJ said a man who admitted to launching the $100 million hack against crypto platform Mango Markets was arrested in Puerto Rico.
- Mango Markets swindler convicted for brazen $110 million crypto manipulation scheme therecord.media U.S. Attorney Damian Williams called it the “first-ever cryptocurrency market manipulation case.”
- Post-Mortem: MAMO Market Incident on Base forum.moonwell.fi Principal account: 0x719e...919D Linked operational account: 0xD71d...C384 Evidence cutoff: Base block 50,524,962, 27 August 2026 at 14:01:11 UTC; supplementary verification through 28 August 2026 Summary On 27 August…
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- jon greig (@jgreigj) on X twitter.com @TheRecord_Media cybersecurity reporter. formerly @zdnet @cambodiadaily @haitiantimes_ — send tips to [email protected] or signal: jgreig.51
- jon greig (@jgreig.bsky.social) bsky.app cybersecurity reporter for The Record. formerly: zdnet, techrepublic, blavity, haitian times, cambodia daily — send tips to [email protected] or signal: jgreig.51
