Cronos blockchain halts and rewinds after Tectonic exploit linked to Crypto.com

The Cronos blockchain, supported by Crypto.com, stopped producing new blocks and reversed part of its transaction history this week after a major security exploit on the Tectonic protocol. The move was taken to prevent further theft from the attack, which security firm PeckShield initially estimated at around $74 million.

Tectonic, a lending protocol in the Cronos DeFi ecosystem—a system of financial apps built on blockchains—had been widely promoted by Crypto.com. The exchange offered TONIC, the protocol’s token, for purchase with over 20 fiat currencies, listed it for trading, and advertised high staking rewards through its platforms.

How the exploit unfolded

Researchers described the attack as a price manipulation scheme similar to the 2022 Mango Markets exploit. The hacker allegedly inflated the price of TONIC, allowing them to withdraw real collateral from DeFi lending protocols using the false price. Tectonic’s price oracle—a tool that feeds real-world price data to blockchains—relied on only two sources: VVS Finance and Crypto.com itself.

After the exploit was detected on Sunday, Cronos validators paused the chain and rolled it back to a state before the attack, effectively erasing the fraudulent transactions. The chain then resumed normal operations.

Crypto.com’s deep ties to Tectonic and Cronos

Crypto.com had heavily integrated Tectonic into its services. It enabled one-click staking for TONIC with no lock-up periods, promoted annual staking returns as high as 100%, and even allowed Visa card spending in TONIC at 80 million merchants. The exchange’s Earn program provided step-by-step guides for TONIC staking, including automatic compounding of rewards.

Tectonic’s documentation highlights its close relationship with Crypto.com. Particle B, Tectonic’s incubator, was later renamed Cronos Labs, which counts Crypto.com’s $500 million investment arm as a strategic partner. Cronos, despite describing itself as a permissionless blockchain, operates with 33 validators selected by invitation only.

Market reaction and past controversies

Following news of the exploit, the price of Cronos’ native token, CRO, dropped by 6% over 24 hours. The total value locked in Cronos DeFi protocols has also declined by 92% since 2022.

This incident adds to Cronos’ history of controversy. In 2021, the chain permanently burned 70 billion CRO tokens to reduce supply. However, in March 2025, it reversed that decision through a community vote—controlled largely by Crypto.com and its affiliated validators—to re-mint the tokens into a strategic reserve, restoring the total supply to 100 billion.

What is confirmed

• Cronos halted and rewound its blockchain to mitigate a $74 million exploit on the Tectonic protocol.
• Tectonic was heavily promoted by Crypto.com, which offered trading, staking, and spending options for its TONIC token.
• The exploit involved price manipulation, with Tectonic’s oracle relying on only two data sources, including Crypto.com.
• Cronos validators are invitation-only, despite the chain’s permissionless branding.
• CRO token’s price fell 6% in 24 hours after the exploit was reported.

Why this matters

The incident raises concerns about the centralization of Cronos, given its invitation-only validator system and Crypto.com’s significant influence over the chain. The reliance on a small number of price oracles for Tectonic also highlights potential vulnerabilities in DeFi protocols, where manipulated data can lead to substantial financial losses.

Sources

• Protos