Verify a decision

{"actor":"system:backfill","investigation_id":"3593ec33-59b4-4f90-bfd6-584a09e35340","kind":"publish","page_slug":"tectonic-protocol","published_at":"2026-09-16T23:05:29.020Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Tectonic Protocol","sections":[{"content":"Tectonic is a decentralized, algorithmic cross-chain money market built on the Cronos blockchain, which is developed and maintained by Crypto.com. The protocol launched its mainnet on December 23, 2021, and was incubated through Cronos Labs. Tectonic is a fork of the Compound protocol, allowing users to supply crypto assets to earn interest or borrow against collateral, with interest rates determined algorithmically based on supply and demand. Prior to the August 2026 exploit, Tectonic was the largest DeFi lending protocol on Cronos, with a total value locked of approximately $121.7 million — representing roughly 46% of all DeFi capital on the Cronos chain. The protocol supported TONIC, its native governance token, as a borrowable and pledgeable collateral asset. Smart contracts had been audited by Particle B's security team, SlowMist, and Blocksec prior to launch.","heading":"Background and Protocol Overview","severity":"low","sources":[{"credibility":2,"name":"Tectonic Mainnet Launch - Medium","type":"official","url":"https://medium.com/tectonicfi/tectonic-mainnet-launch-d087fe485d8"},{"credibility":2,"name":"Cronos Ecosystem Spotlight: Tectonic","type":"news_article","url":"https://blog.cronos.org/p/cronos-ecosystem-spotlight-tectonic"},{"credibility":2,"name":"KuCoin: Cronos Network Halts After $75M Tectonic Exploit","type":"news_article","url":"https://www.kucoin.com/blog/en-cronos-network-halts-after-75m-tectonic-exploit-how-tonic-price-manipulation-drained-a-major-lending-protocol"}]},{"content":"On August 30, 2026, an unidentified attacker exploited Tectonic in what security firm PeckShield classified as an economic exploit rather than a code vulnerability — the protocol's smart contracts operated as written, but the parameters governing acceptance of a low-liquidity token as collateral were insufficiently protective against price manipulation. The attack followed a pattern described by researchers as a 'Mango Markets-style pump-and-borrow' exploit. The attacker began at approximately 12:38:56 UTC by deploying contracts and purchasing large quantities of TONIC across three thin liquidity pools. Before the attack, TONIC had approximately $1.34 million in available liquidity and roughly $11,000 in daily trading volume. The attacker spent approximately $600,000 to push TONIC's price approximately 100-fold (some sources report up to 300-fold) within roughly 20 minutes. Tectonic accepted TONIC as collateral with a 20% collateral factor, meaning every $100 of recognized TONIC value supported approximately $20 in borrowing capacity. At 12:49:39 UTC, in a single transaction, the attacker used the artificially inflated collateral to borrow an estimated $120.4 million in liquid assets across nine Tectonic markets, including USDC, USDT, wrapped Bitcoin, wrapped Ether, and CRO. The root structural vulnerability was the protocol's acceptance of a governance token with minimal liquidity and no circuit-breaker oracle safeguards as meaningful collateral. TRM Labs noted that the $120.4 million borrowed represented 245 times TONIC's weekly trading volume in the period preceding the attack.","heading":"August 2026 Price-Manipulation Exploit","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: Cronos Halts Blockchain After $75 Million Lending Exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic"},{"credibility":1,"name":"The Block: Crypto.com-linked Cronos Network Halts After Tectonic Exploit","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-30-crypto-com-linked-cronos-network-halts-after-tectonic-exploit-estimated-at-75-million-413069"},{"credibility":2,"name":"Halborn: Explained the Tectonic Hack August 2026","type":"research","url":"https://www.halborn.com/blog/post/explained-the-tectonic-hack-august-2026"},{"credibility":2,"name":"TRM Labs: Number of Price-Manipulation Attacks Hits All-Time High","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"CryptoTimes: Cronos Halts Entire Blockchain After $75M Tectonic Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/cronos-halts-entire-blockchain-after-75m-tectonic-exploit-only-6m-escapes/"},{"credibility":2,"name":"FinanceFeeds: Tectonic Exploited on Cronos for Estimated $75 Million","type":"news_article","url":"https://financefeeds.com/tectonic-exploited-on-cronos-for-estimated-75-million-as-validators-halt-entire-network/"}]},{"content":"The Cronos network team detected irregular activity at approximately 13:25:00 UTC and validators halted block production at 14:32:47 UTC, at block 90,907,150, approximately two hours after the exploit began. This was the first chain halt in Cronos history. The halt prevented approximately $111 million in stolen assets that remained on Cronos from being moved cross-chain. Approximately $6.29 million had already been bridged to Ethereum before the halt, primarily as USDC which the attacker subsequently converted to approximately 2,592 ETH. Following validator coordination, Cronos executed a rollback of 10,961 blocks — equivalent to 1 hour and 54 minutes of chain history — restoring the chain to block 90,896,188, the last block before the attack. Block production resumed at 23:49:01 UTC on August 30, 2026, from block 90,896,189. On September 8, 2026, Cronos published a formal post-mortem confirming: $120.4 million was borrowed in the exploit; $111.2 million was recovered via the rollback; and $9.19 million remains permanently unrecovered. The post-mortem document states it 'does not constitute an admission of liability' and is 'informational only.' As of September 2026, Cronos has not published a list of affected third-party venues, a recovery deadline, or a compensation policy for the $9.19 million that was irretrievably lost.","heading":"Cronos Blockchain Halt and Chain Rollback","severity":"critical","sources":[{"credibility":2,"name":"CryptoTimes: Cronos Rewound 10,961 Blocks to Reverse Tectonic Hack, $9.19M Still Missing","type":"news_article","url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"credibility":1,"name":"CoinDesk: Cronos Executes Controversial Blockchain Rollback to Recover Crypto Worth $111 Million","type":"news_article","url":"https://www.coindesk.com/business/2026/09/08/cronos-executes-controversial-blockchain-rollback-to-recover-crypto-worth-usd111-million"},{"credibility":2,"name":"CryptoSlate: Cronos Validators Erase Transaction History","type":"news_article","url":"https://cryptoslate.com/cronos-restart-after-tectonic-exploit-chain-rollback/"},{"credibility":1,"name":"The Block: Cronos Says $9.2 Million Remains Unrecovered After Tectonic Exploit","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-09-08-cronos-post-mortem-413724"}]},{"content":"The Cronos chain rollback generated significant debate within the broader blockchain community regarding decentralization and the principle of transaction finality. The halt and rollback demonstrated that Cronos's 100-validator consensus set is capable of coordinating to stop block production and reverse chain state — a capability that inherently challenges claims of permissionless, immutable transaction settlement. Every transaction within the discarded 10,961-block window was reversed regardless of whether it touched the exploit, meaning users who swapped assets, repaid loans, or opened unrelated positions during that 114-minute period had their actions erased. The Cronos post-mortem acknowledged that 'communication during that window is where we can do better.' Commentators drew parallels to BNB Chain's 2022 recovery of approximately $470 million from a $570 million bridge exploit via a similar validator-coordinated halt, and to Flow's decision not to roll back its chain following a smaller $3.9 million exploit in December of a prior year. The incident also drew comparison to the 2022 Mango Markets exploit on Solana, which used an identical pump-and-borrow mechanism. The Mango attacker, Avraham Eisenberg, was convicted of commodities fraud in April 2024, though a federal judge vacated those convictions in May 2025, leaving that case in active litigation; no analogous legal proceedings have been publicly confirmed against the Tectonic attacker.","heading":"Decentralization and Immutability Concerns","severity":"high","sources":[{"credibility":2,"name":"CryptoTimes: Cronos Rewound 10,961 Blocks","type":"news_article","url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"credibility":2,"name":"TFTC: Cronos Halt Tectonic Exploit $75 Million","type":"news_article","url":"https://www.tftc.io/cronos-halt-tectonic-exploit-75-million"},{"credibility":2,"name":"247 Wall St: Crypto.com's Blockchain Rewound Two Hours to Undo a $74 Million Exploit","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/09/09/crypto-coms-blockchain-rewound-two-hours-to-undo-a-74-million-exploit-could-bitcoin-or-ethereum-ever-do-the-same/"},{"credibility":3,"name":"AirdropAlert: Cronos Rollback — The $75M Tectonic Exploit That Got Erased","type":"news_article","url":"https://airdropalert.com/blogs/cronos-rollback-tectonic-exploit/"}]},{"content":"As of September 2026, the attacker's identity remains unknown and no arrests or legal proceedings have been publicly reported. The approximately $6.29 million successfully bridged to Ethereum before the chain halt was first moved as USDC, then converted to approximately 2,592 ETH. On September 3, 2026, security firm PeckShield reported that approximately 2,658.9 ETH (approximately $6.65 million at that time) was deposited into Tornado Cash, the Ethereum-based cryptocurrency mixer. This transaction effectively obscured the trail of the unrecovered funds. No on-chain bounty, white-hat negotiation, or public communication from the attacker has been reported.","heading":"Attacker Identity and Fund Movement","severity":"high","sources":[{"credibility":2,"name":"Cryptopolitan: Tectonic Attacker Sends 2,659 ETH to Tornado Cash","type":"news_article","url":"https://www.cryptopolitan.com/tectonic-attacker-sends-2659-eth-to-tornado-cash/"},{"credibility":2,"name":"TRM Labs: Number of Price-Manipulation Attacks Hits All-Time High","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"Nairametrics: Attacker Pumps Tectonic Token 300-Fold, Drains $6 Million","type":"news_article","url":"http://nairametrics.com/2026/08/31/attacker-pumps-tectonic-token-300-fold-drains-6-million-in-crypto/"}]},{"content":"Following the exploit and rollback, Tectonic's total value locked collapsed from approximately $121.7 million to roughly $3 million. The exploit generated an estimated $8.71 million in forced liquidations and left approximately $32.6 million in bad debt. Tectonic's team advised users not to interact with the protocol until the team confirmed it was safe to do so. As of the September 8, 2026 post-mortem, neither Tectonic nor Cronos had announced a compensation plan for affected users or a concrete timeline for protocol reopening. Crypto.com CEO Kris Marszalek publicly stated that Crypto.com's exchange and app were unaffected by the exploit and operating normally. The broader Cronos DeFi ecosystem lost approximately 46% of its total capital in a single incident.","heading":"Protocol Impact and Current Status","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: Cronos Executes Controversial Blockchain Rollback","type":"news_article","url":"https://www.coindesk.com/business/2026/09/08/cronos-executes-controversial-blockchain-rollback-to-recover-crypto-worth-usd111-million"},{"credibility":2,"name":"KuCoin: Cronos Network Halts After $75M Tectonic Exploit","type":"news_article","url":"https://www.kucoin.com/blog/en-cronos-network-halts-after-75m-tectonic-exploit-how-tonic-price-manipulation-drained-a-major-lending-protocol"},{"credibility":2,"name":"CryptoTimes: Cronos Rewound 10,961 Blocks","type":"news_article","url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"}]},{"content":"The Tectonic incident occurred against a backdrop of rising price-manipulation attacks in DeFi. According to TRM Labs, 2026 saw a record number of price-manipulation incidents, with 32 recorded through the year — representing approximately one in eight crypto hacks, up from one in 17 in 2022. The Tectonic attack followed a similar $8.7 million price-manipulation exploit at the Moonwell protocol on August 27, 2026, just three days earlier. Security firm PeckShield noted that August 2026 set a monthly record for the number of distinct hack incidents. Hacken, another security firm, characterized the Tectonic incident as illustrating 'why collateral factors can fail when the underlying price can be manipulated,' and noted that the chain halt functioned as a circuit breaker where protocol-level safeguards were insufficient.","heading":"Broader Industry Context","severity":"medium","sources":[{"credibility":2,"name":"TRM Labs: Number of Price-Manipulation Attacks Hits All-Time High","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"CryptoRank: August Broke 2026's Monthly Hack Record","type":"news_article","url":"https://cryptorank.io/news/feed/ddbd7-august-crypto-hacks-2026-record-peckshield"},{"credibility":3,"name":"Hacken on X: Tectonic Collateral Factor Analysis","type":"social_media","url":"https://x.com/hackenclub/status/2095519338543358232"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: Cronos Halts Blockchain After $75 Million Lending Exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/31/cronos-halts-blockchain-after-usd75-million-lending-exploit-hits-lending-app-tectonic"},{"credibility":1,"name":"CoinDesk: Cronos Executes Controversial Blockchain Rollback to Recover Crypto Worth $111 Million","type":"news_article","url":"https://www.coindesk.com/business/2026/09/08/cronos-executes-controversial-blockchain-rollback-to-recover-crypto-worth-usd111-million"},{"credibility":1,"name":"The Block: Crypto.com-linked Cronos Network Halts After Tectonic Exploit","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-30-crypto-com-linked-cronos-network-halts-after-tectonic-exploit-estimated-at-75-million-413069"},{"credibility":1,"name":"The Block: Cronos Says $9.2 Million Remains Unrecovered After Tectonic Exploit","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-09-08-cronos-post-mortem-413724"},{"credibility":2,"name":"Halborn: Explained the Tectonic Hack August 2026","type":"research","url":"https://www.halborn.com/blog/post/explained-the-tectonic-hack-august-2026"},{"credibility":2,"name":"TRM Labs: Number of Price-Manipulation Attacks Hits All-Time High","type":"research","url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"credibility":2,"name":"KuCoin: Cronos Network Halts After $75M Tectonic Exploit","type":"news_article","url":"https://www.kucoin.com/blog/en-cronos-network-halts-after-75m-tectonic-exploit-how-tonic-price-manipulation-drained-a-major-lending-protocol"},{"credibility":2,"name":"CryptoTimes: Cronos Halts Entire Blockchain After $75M Tectonic Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/cronos-halts-entire-blockchain-after-75m-tectonic-exploit-only-6m-escapes/"},{"credibility":2,"name":"CryptoTimes: Cronos Rewound 10,961 Blocks to Reverse Tectonic Hack","type":"news_article","url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"credibility":2,"name":"CryptoSlate: Cronos Validators Erase Transaction History","type":"news_article","url":"https://cryptoslate.com/cronos-restart-after-tectonic-exploit-chain-rollback/"},{"credibility":2,"name":"Cryptopolitan: Tectonic Attacker Sends 2,659 ETH to Tornado Cash","type":"news_article","url":"https://www.cryptopolitan.com/tectonic-attacker-sends-2659-eth-to-tornado-cash/"},{"credibility":2,"name":"FinanceFeeds: Tectonic Exploited on Cronos for Estimated $75 Million","type":"news_article","url":"https://financefeeds.com/tectonic-exploited-on-cronos-for-estimated-75-million-as-validators-halt-entire-network/"},{"credibility":2,"name":"TFTC: Cronos Halt Tectonic Exploit $75 Million","type":"news_article","url":"https://www.tftc.io/cronos-halt-tectonic-exploit-75-million"},{"credibility":2,"name":"247 Wall St: Crypto.com's Blockchain Rewound Two Hours","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/09/09/crypto-coms-blockchain-rewound-two-hours-to-undo-a-74-million-exploit-could-bitcoin-or-ethereum-ever-do-the-same/"},{"credibility":2,"name":"Tectonic Mainnet Launch - Medium","type":"official","url":"https://medium.com/tectonicfi/tectonic-mainnet-launch-d087fe485d8"},{"credibility":2,"name":"Cronos Ecosystem Spotlight: Tectonic","type":"official","url":"https://blog.cronos.org/p/cronos-ecosystem-spotlight-tectonic"},{"credibility":2,"name":"CryptoRank: August Broke 2026's Monthly Hack Record","type":"news_article","url":"https://cryptorank.io/news/feed/ddbd7-august-crypto-hacks-2026-record-peckshield"},{"credibility":3,"name":"AirdropAlert: Cronos Rollback — The $75M Tectonic Exploit That Got Erased","type":"news_article","url":"https://airdropalert.com/blogs/cronos-rollback-tectonic-exploit/"}],"summary":"Tectonic is a decentralized lending protocol on Crypto.com's Cronos blockchain, forked from Compound and launched in December 2021. On August 30, 2026, an unidentified attacker exploited the protocol by manipulating the price of its thinly traded TONIC governance token approximately 100-fold in roughly 20 minutes, then borrowed an estimated $120.4 million in liquid assets against the inflated collateral. The incident forced Cronos validators to halt the entire blockchain and execute a controversial rollback of 10,961 blocks, reversing approximately $111.2 million in stolen funds while leaving $9.19 million permanently unrecovered. The exploit caused Tectonic's total value locked to collapse from approximately $121.7 million to roughly $3 million.","timeline":[{"date":"2021-12-23","event":"Tectonic mainnet launched on Cronos blockchain, incubated by Cronos Labs, forked from Compound protocol.","source":"Tectonic Medium","source_url":"https://medium.com/tectonicfi/tectonic-mainnet-launch-d087fe485d8"},{"date":"2026-08-27","event":"Moonwell protocol exploited for $8.7 million via price manipulation — a precursor incident using similar methods three days before the Tectonic attack.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"date":"2026-08-30","event":"At 12:38:56 UTC, the attacker deployed contracts and began purchasing TONIC across thin liquidity pools, inflating the token's price approximately 100-fold in roughly 20 minutes.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"date":"2026-08-30","event":"At 12:49:39 UTC, attacker borrowed an estimated $120.4 million in liquid assets (USDC, USDT, wrapped BTC, wrapped ETH, CRO) in a single transaction using inflated TONIC as collateral.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"date":"2026-08-30","event":"Approximately $6.29 million bridged from Cronos to Ethereum before the chain halt, converted to approximately 2,592 ETH.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/number-of-price-manipulation-attacks-hits-all-time-high-as-usd-75-million-is-stolen-from-tectonic"},{"date":"2026-08-30","event":"At 13:25:00 UTC, Cronos team detected irregular activity. At 14:32:47 UTC, validators halted the entire Cronos blockchain at block 90,907,150 — the first chain halt in Cronos history.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"date":"2026-08-30","event":"At 23:49:01 UTC, Cronos block production resumed from block 90,896,189, after validators rolled back 10,961 blocks (1 hour 54 minutes of chain history) to the last pre-exploit state.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/"},{"date":"2026-09-03","event":"PeckShield reported approximately 2,658.9 ETH (approximately $6.65 million) deposited into Tornado Cash mixer by the attacker's wallet, effectively obscuring the trail of unrecovered funds.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/tectonic-attacker-sends-2659-eth-to-tornado-cash/"},{"date":"2026-09-08","event":"Cronos published a formal post-mortem confirming: $120.4 million total exploit, $111.2 million recovered via rollback, $9.19 million permanently unrecovered. No compensation plan or attacker identification announced.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/09/08/cronos-executes-controversial-blockchain-rollback-to-recover-crypto-worth-usd111-million"}]},"v":1}