← Tectonic / Cronos — August 2026 TONIC Price Manipulation Exploitreviewed 2026-09-07 · 45 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Tectonic / Cronos — August 2026 TONIC Price Manipulation Exploit against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #36[disputed][awaiting moderator]in the timeline
“2022-02-01”
reviewerTONIC assigned a 20% collateral factor on 2022-02-01, unchanged until the 2026 exploitThe stored date (2022-02-01) precedes the date Tectonic itself announced the reduction schedule to 20% would begin (Feb 14, 2022); the parameter could not have been fixed at 20% on Feb 1. The exact date the schedule concluded at 20% could not be pinned down precisely, but Feb 14, 2022 is the best-documented anchor date and is closer to accurate than Feb 1.Proposed correction (not yet applied)2022-02-14
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #31[stale][awaiting moderator]in section: Broader Context: Price Manipulation Attacks in 2026
“The Mango Markets case resulted in criminal charges and a conviction; no comparable legal action has been announced in connection with the Tectonic exploit as of September 1, 2026.”
reviewerThe Mango Markets case resulted in criminal charges and a conviction, with no comparable legal action for the Tectonic exploitThe page presents 'a conviction' as a settled, current fact, but the 2024 conviction was vacated by a federal judge in May 2025 and the case remains on appeal with an uncertain outcome as of the page's own reference date.Proposed correction (not yet applied)The Mango Markets case resulted in criminal charges and a 2024 conviction that a federal judge vacated in May 2025, with the government's appeal of that ruling pending before the Second Circuit as of September 1, 2026; no comparable legal action has been announced in connection with the Tectonic exploit as of that date.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #30[partially supported][awaiting moderator]in section: Broader Context: Price Manipulation Attacks in 2026
“The structural pattern — accepting a governance token with thin liquidity as collateral at a non-zero collateral factor without adequate price-manipulation circuit breakers — mirrors the October 2022 Mango Markets incident, in which trader Avraham Eisenberg similarly manipulated the price of MNGO and borrowed approximately $100 million against inflated collateral.”
reviewerEisenberg's Mango Markets exploit involved borrowing approximately $100 million against inflated collateralThe most commonly cited figures for the Mango Markets exploit are $110 million (court/most outlets) to $116 million (SEC); $100 million understates the widely reported amount by 10-16%. - #37[partially supported][awaiting moderator]in the timeline
“Mango Markets exploit: trader Avraham Eisenberg manipulates MNGO token price to borrow approximately $100 million in a structurally analogous attack.”
reviewerMango Markets exploit: Eisenberg manipulated MNGO to borrow approximately $100 million — timeline entrySame underlying understatement as the sections[6] Mango Markets figure; both should be corrected together.
confirmed
41 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On August 30, 2026, an unknown attacker manipulated the price of TONIC — the thinly traded governance token of Tectonic, the dominant lending protocol on the Cronos blockchain — by approximately 100-fold in roughly 20 minutes, then deposited the artificially inflated tokens as collateral and borrowed an estimated $75 million in liquid assets from the protocol's pools.”
reviewerAttacker manipulated TONIC price ~100-fold in ~20 minutes and borrowed an estimated $75 million against itWidely corroborated across TRM Labs, CoinDesk, and multiple crypto trade outlets. - #2[confirmed][no action needed]in the summary
“Cronos validators halted all block production network-wide within minutes, freezing approximately $68.7 million on-chain; roughly $6 million had already been bridged to Ethereum before the halt and could not be recovered by rollback.”
reviewerCronos validators halted block production network-wide, freezing ~$68.7M; ~$6M had already bridged to Ethereum and was unrecoverableFigures consistent across The Defiant, CryptoTimes, and AMBCrypto reporting. - #3[confirmed][no action needed]in the summary
“Validators subsequently rolled the chain back to its pre-attack state — discarding approximately 11,000 blocks and reversing nearly two hours of third-party transactions — and resumed block production at block 90,896,189 (23:49:01 UTC, August 30).”
reviewerRollback discarded ~11,000 blocks, reversed ~2 hours of transactions, resumed at block 90,896,189 at 23:49:01 UTCBlock numbers and timestamp independently corroborated by multiple outlets and a Cronos Network X post. - #4[confirmed][no action needed]in the summary
“As of September 1, 2026, no compensation plan, final loss figure, or formal post-mortem had been published by Tectonic or Cronos Labs.”
reviewerAs of September 1, 2026, no compensation plan, final loss figure, or post-mortem had been publishedConfirmed as still accurate through the time of this review (early September 2026). - #5[confirmed][no action needed]in section: Incident Overview
“On August 30, 2026, Tectonic — the largest decentralized lending protocol on Crypto.com's Cronos blockchain — suffered a price manipulation exploit estimated at approximately $75 million, making it the dominant loss event in a month that saw a record 50 crypto-security incidents totaling roughly $136 million (per PeckShield).”
reviewerAugust 2026 saw a record 50 crypto-security incidents totaling roughly $136 million per PeckShieldFigure matches PeckShield-sourced reporting. - #6[confirmed][no action needed]in section: Incident Overview
“The attacker exploited a structural weakness: TONIC, Tectonic's governance token, held a 20% collateral factor inside the protocol despite having only approximately $1.34 million in liquidity and roughly $11,000 in daily trading volume.”
reviewerTONIC held a 20% collateral factor despite ~$1.34M liquidity and ~$11,000 daily trading volumeConfirmed. - #7[confirmed][no action needed]in section: Incident Overview
“The attack followed the same structural template as the October 2022 Mango Markets exploit, in which Avraham Eisenberg manipulated a thinly traded governance token to borrow against inflated collateral.”
reviewerThe attack followed the Mango Markets structural template of manipulating a thin governance token to borrow against inflated collateralDescribes the mechanism, not a specific figure; accurate. - #8[confirmed][no action needed]in section: Incident Overview
“PeckShield classified this as the fourth-largest cryptocurrency theft of 2026.”
reviewerPeckShield classified the Tectonic exploit as the fourth-largest cryptocurrency theft of 2026Confirmed verbatim by the cited reporting. - #9[confirmed][no action needed]in section: Attack Mechanism
“TONIC traded only $305,931 in the full week preceding the exploit and held approximately $1.34 million in on-chain liquidity, a market depth insufficient to absorb significant buy pressure without extreme price movement.”
reviewerTONIC traded only $305,931 in the week before the exploit and held ~$1.34M in on-chain liquidityConfirmed. - #10[confirmed][no action needed]in section: Attack Mechanism
“Because Tectonic's price oracle relied on market-based price feeds — reportedly sourcing TONIC/USD pricing from only two venues, VVS Finance and Crypto.com — the inflated market price was accepted by the protocol as the collateral valuation.”
reviewerTectonic's TONIC/USD oracle sourced pricing from only two venues, VVS Finance and Crypto.comConfirmed by direct reporting on Tectonic's own oracle configuration. - #11[confirmed][no action needed]in section: Attack Mechanism
“On-chain analysis traces the opening move to a single block in which the attacker deposited 3,091 TONIC and borrowed 3,697 TONIC; within that block the oracle price jumped 6.46x, unlocking approximately $125.6 million in gross borrowing capacity.”
reviewerAttacker deposited 3,091 TONIC and borrowed 3,697 TONIC in the opening block; oracle price jumped 6.46x, unlocking ~$125.6M in borrowing capacityConfirmed. - #12[confirmed][no action needed]in section: Attack Mechanism
“Against this manipulated collateral value, the attacker withdrew approximately $54.32 million in USDC, $44.87 million in USDT, 95.36 WBTC, 1,861 WETH, and 39.61 million CRO.”
reviewerAttacker withdrew ~$54.32M USDC, $44.87M USDT, 95.36 WBTC, 1,861 WETH, and 39.61M CROConfirmed. - #13[confirmed][no action needed]in section: Attack Mechanism
“TONIC's collateral factor had been in place since approximately February 2022, and the token's shallow liquidity had not been treated as a disqualifying risk parameter.”
reviewerThe 20% collateral factor proved inadequate against distorted prices; TONIC's collateral factor had been in place since approximately February 2022The hedged prose is accurate; the precise date problem is isolated to the timeline field, flagged separately. - #14[confirmed][no action needed]in section: Financial Impact and Fund Flows
“A separate on-chain analysis measuring gross pool outflows before liquidations placed the figure at approximately $119.5 million, though the $75 million figure — representing attacker proceeds rather than gross outflow — is the figure most widely cited by major outlets.”
reviewerA separate on-chain analysis measuring gross pool outflows placed the figure at ~$119.5 millionConfirmed and correctly distinguishes gross outflow from net proceeds. - #15[confirmed][no action needed]in section: Financial Impact and Fund Flows
“Tectonic's total value locked stood at approximately $121.7 million as of August 26, 2026 (per DefiLlama), representing close to half of all capital deposited across Cronos DeFi at the time; that figure had fallen to approximately $3 million by August 31, a 97.5% collapse.”
reviewerTectonic TVL was ~$121.7M on Aug 26 (near half of Cronos DeFi) and fell to ~$3M by Aug 31, a 97.5% collapseConfirmed across CoinDesk and Decrypt. - #16[confirmed][no action needed]in section: Financial Impact and Fund Flows
“The incident triggered 752 liquidations across other user positions, with approximately $8.71 million seized from third parties.”
reviewer752 liquidations occurred, seizing ~$8.71 million from third partiesConfirmed; note the page omits a related detail that copycat bots reportedly took an additional ~$2M (see coverage_gaps). - #17[confirmed][no action needed]in section: Financial Impact and Fund Flows
“Approximately $32.6 million in residual bad debt was left inside the protocol following the attack and subsequent liquidations.”
reviewerApproximately $32.6 million in residual bad debt was left inside the protocolConfirmed. - #18[confirmed][no action needed]in section: Financial Impact and Fund Flows
“Of the funds the attacker attempted to move: approximately $6.29 million reached Ethereum (converted into roughly 2,592 ETH via USDC) before validators halted the network; approximately $68.7 million remained on Cronos and was reversed by the rollback.”
reviewer~$6.29M reached Ethereum (2,592 ETH) before the halt; ~$68.7M remained on Cronos and was reversedConfirmed. - #19[confirmed][no action needed]in section: Financial Impact and Fund Flows
“The attacker-associated addresses identified on-chain include: 0x7d4e...4f2dc (approximately $60 million on Cronos), 0xc404...72dd (approximately $6 million bridged to Ethereum), and 0x215a...d3fc (approximately $8 million on Cronos).”
reviewerAttacker-associated addresses: 0x7d4e...4f2dc (~$60M Cronos), 0xc404...72dd (~$6M bridged), 0x215a...d3fc (~$8M Cronos)Confirmed via independent search corroboration of PeckShield's address attribution. - #20[confirmed][no action needed]in section: Financial Impact and Fund Flows
“No attacker identity has been publicly attributed by TRM Labs or any other named security firm as of September 1, 2026.”
reviewerNo attacker identity has been publicly attributed by TRM Labs or any other named security firm as of September 1, 2026Directly confirmed by TRM Labs' own language. - #21[confirmed][no action needed]in section: Network Response: Halt and Rollback
“Cronos validators halted block production at block 90,907,150 (14:32:47 UTC, August 30, 2026) within minutes of detecting the exploit.”
reviewerCronos validators halted block production at block 90,907,150 (14:32:47 UTC, August 30, 2026)Confirmed. - #22[confirmed][no action needed]in section: Network Response: Halt and Rollback
“Cronos operates on Tendermint consensus with a validator set capped at 100, a structure that made rapid coordination feasible.”
reviewerCronos operates on Tendermint consensus with a validator set capped at 100Confirmed by protocol documentation. - #23[confirmed][no action needed]in section: Network Response: Halt and Rollback
“After approximately nine to ten hours of inactivity, validators rolled the chain state back to block 90,896,189, with a restored timestamp of 23:49:01 UTC on August 30.”
reviewerAfter ~9-10 hours of inactivity, validators rolled back to block 90,896,189 at a restored timestamp of 23:49:01 UTC on August 30Confirmed; note block 90,896,189's original mining timestamp (~12:38-12:39 UTC, i.e., before the attack) is distinct from the 23:49:01 UTC real-world restart time the page correctly cites. - #24[confirmed][no action needed]in section: Network Response: Halt and Rollback
“This rollback discarded approximately 11,000 blocks, erasing the attacker's on-chain Cronos balances along with approximately two hours of all other users' transactions.”
reviewerRollback discarded ~11,000 blocks, erasing attacker balances and ~2 hours of other users' transactionsConfirmed. - #25[confirmed][no action needed]in section: Tectonic Protocol Background and Crypto.com Relationship
“Tectonic launched on Cronos mainnet on December 23, 2021, as an algorithmic cross-chain money market protocol.”
reviewerTectonic launched on Cronos mainnet on December 23, 2021 as an algorithmic cross-chain money market protocolConfirmed. - #26[confirmed][no action needed]in section: Tectonic Protocol Background and Crypto.com Relationship
“The protocol was incubated by Particle B, subsequently renamed Cronos Labs, the ecosystem development arm associated with Crypto.com.”
reviewerTectonic was incubated by Particle B, subsequently renamed Cronos LabsConfirmed. - #27[confirmed][no action needed]in section: Tectonic Protocol Background and Crypto.com Relationship
“Crypto.com actively promoted TONIC through its main exchange (listing and trading), offered TONIC purchases in more than 20 fiat currencies, advertised staking yields of up to 100% per annum, and promoted TONIC staking within its DeFi Wallet with one-click access.”
reviewerCrypto.com promoted TONIC via its exchange, 20+ fiat currencies, up-to-100% APY staking, and DeFi Wallet one-click stakingConfirmed by the primary cited source. - #28[confirmed][no action needed]in section: Tectonic Protocol Background and Crypto.com Relationship
“As of August 31, 2026, Crypto.com's CEO confirmed that Crypto.com's centralized exchange and app were unaffected by the exploit, but neither Crypto.com nor Cronos Labs had announced a compensation plan for Tectonic depositors whose funds were affected by the protocol's bad debt.”
reviewerCrypto.com's CEO confirmed the exchange/app were unaffected by the exploitConfirmed and no compensation plan had been announced as of the cited date. - #29[confirmed][no action needed]in section: Broader Context: Price Manipulation Attacks in 2026
“TRM Labs reported that price-manipulation exploits reached an all-time high in 2026, with 32 incidents recorded across the year through the date of its analysis — exceeding any prior year and representing approximately one in eight hacks, up from approximately one in seventeen in 2022.”
reviewerPrice-manipulation exploits hit an all-time high in 2026 (32 incidents), ~1-in-8 hacks, up from ~1-in-17 in 2022Confirmed verbatim by TRM Labs. - #32[confirmed][no action needed]in section: Recovery Status and Outstanding Questions
“No compensation plan has been announced for Tectonic depositors facing the approximately $32.6 million in residual bad debt.”
reviewerNo compensation plan has been announced for Tectonic depositors facing ~$32.6M in residual bad debtConfirmed. - #33[confirmed][no action needed]in section: Recovery Status and Outstanding Questions
“The attacker-controlled addresses on Cronos were erased by the rollback, but the approximately $6.29 million already bridged to Ethereum (converted into roughly 2,592 ETH) remains under the attacker's control and beyond the reach of any on-chain reversal.”
reviewerThe ~$6.29 million bridged to Ethereum remains under attacker control and beyond on-chain reversalConfirmed; consistent with the basic mechanics of a single-chain rollback. - #34[confirmed][no action needed]in section: Recovery Status and Outstanding Questions
“No law enforcement referral, regulatory filing, or chain-analytics attribution to a named party has been publicly disclosed.”
reviewerNo law enforcement referral, regulatory filing, or chain-analytics attribution to a named party has been publicly disclosedNo contrary reporting found through the review date. - #35[confirmed][no action needed]in the timeline
“Tectonic launches on Cronos mainnet as an algorithmic money market protocol, incubated by Particle B (later Cronos Labs).”
reviewerTectonic launched on Cronos mainnet as an algorithmic money market protocol, incubated by Particle B (later Cronos Labs) — timeline entryConfirmed, consistent with sections[5] finding. - #38[confirmed][no action needed]in the timeline
“Tectonic TVL stands at approximately $121.7 million, representing close to half of all capital deposited across Cronos DeFi at the time.”
reviewerTectonic TVL stood at ~$121.7 million on 2026-08-26, near half of Cronos DeFi capitalConfirmed. - #39[confirmed][no action needed]in the timeline
“Attacker begins price manipulation of TONIC, inflating price approximately 100-fold in roughly 20 minutes. Oracle price jumps 6.46x within a single block, unlocking approximately $125.6 million in borrowing capacity. Attacker withdraws approximately $54.32M USDC, $44.87M USDT, 95.36 WBTC, 1,861 WETH, and 39.61M CRO.”
reviewerAttacker begins TONIC price manipulation (100x/20min), oracle jumps 6.46x, unlocks ~$125.6M, withdraws breakdown as stated — timeline entryConfirmed, consistent with sections[1]. - #40[confirmed][no action needed]in the timeline
“Approximately $6.29 million bridged from Cronos to Ethereum (converted into roughly 2,592 ETH via USDC) before validators halt the network.”
reviewer~$6.29 million bridged from Cronos to Ethereum (2,592 ETH via USDC) before the halt — timeline entryConfirmed. - #41[confirmed][no action needed]in the timeline
“Cronos validators halt block production at block 90,907,150 (14:32:47 UTC), freezing approximately $68.7 million on-chain. Network-wide halt affects all users, not only Tectonic depositors.”
reviewerCronos validators halted block production at block 90,907,150 (14:32:47 UTC), freezing ~$68.7M — timeline entryConfirmed. - #42[confirmed][no action needed]in the timeline
“Cronos CEO (Crypto.com CEO) states the Crypto.com exchange and app are unaffected. Tectonic advises users not to interact with the protocol.”
reviewerCrypto.com CEO states exchange/app unaffected; Tectonic advises users not to interact with the protocol — timeline entryConfirmed, though note the label 'Cronos CEO' conflates Crypto.com's CEO with Cronos governance; Kris Marszalek is Crypto.com's CEO and closely associated with Cronos, which the page's parenthetical correctly clarifies. - #43[confirmed][no action needed]in the timeline
“Validators roll back chain state to block 90,896,189 (23:49:01 UTC) and resume block production. Approximately 11,000 blocks discarded, reversing roughly two hours of all network transactions.”
reviewerValidators roll back to block 90,896,189 (23:49:01 UTC) and resume; ~11,000 blocks discarded, ~2 hours reversed — timeline entryConfirmed. - #44[confirmed][no action needed]in the timeline
“Tectonic TVL reported at approximately $3 million, down from $121.7 million five days prior — a 97.5% collapse. Approximately $32.6 million in bad debt remains inside the protocol.”
reviewerTectonic TVL reported at ~$3 million on 2026-08-31, down from $121.7 million, 97.5% collapse; ~$32.6M bad debt remains — timeline entryConfirmed. - #45[confirmed][no action needed]in the timeline
“PeckShield reports August 2026 as a record month for crypto-hack frequency (50 incidents, $136.3 million total losses). Tectonic accounts for more than half the monthly loss total. No compensation plan or post-mortem published as of this date.”
reviewerPeckShield reports August 2026 as a record month (50 incidents, $136.3M losses); Tectonic >half; no compensation/post-mortem yet — timeline entryConfirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.