Cronos, associated with Crypto.com, halted block production on Sunday. The network reported an attack on the largest lending protocol, Tectonic. On-chain researcher Weilin Li estimated the affected assets to be around $75 million, while the protocol itself has not yet officially confirmed the amount or the root cause.

The researcher described the path as follows: artificially inflating the price of the governance token TONIC, which has very poor liquidity, and then using the inflated tokens as collateral to borrow other assets, similar to the 2022 Mango Markets oracle manipulation. Within about twenty minutes, the price was driven up to a hundred times; based on an estimated 20% collateral factor, the massive TONIC in the attack position would need to be marked at approximately $375 million to support about $75 million in borrowing.

The direction of funds is more critical than the total amount. Before the halt, the attacker only bridged out about $6 million to Ethereum, while approximately $60 million remained in the Cronos address. Crypto.com stated that its app and exchange were unaffected, and customer funds were safe; Tectonic operates independently, and it has not yet been announced whether depositors will be compensated. According to DefiLlama, the protocol has locked up about $121.6 million, accounting for about 46% of the entire chain's decentralized finance, with the next lending platform being almost negligible.

The validator set is limited, making it possible to coordinate a block halt. The next steps involve choosing between rollback, blacklisting the attack address, or restarting in the original state, which will determine whether frozen funds can be returned to depositors. The halt itself proves that the network can pause, and it also shows that block production rights are concentrated among a group of nodes that can hold meetings.

CRO rose in the short term, as traders bet that losses were locked within the chain. This is a reaction to the price of "not escaping," rather than an audit of the protocol's solvency.

In market mechanics, the sellers are the set of validators capable of halting the chain, while the buyers are depositors who still use the poorly liquid governance token as collateral. The event is driven by the mismatch between the oracle and thinly traded tokens. Funds were intercepted on the bridge, with most not yet entering Ethereum for exchange. Benefiting are the exchanges that isolate the narrative; under pressure are Tectonic depositors, users who treat a single protocol as the entire chain's money market, and the decentralized rhetoric of "the chain cannot stop."

Source: Public Information