TheBlockRadar
Explainer· Independently researched

Tectonic Crypto Exploit

Explore the Tectonic crypto exploit, its impact on Cronos, and how collateral manipulation led to a $75M loss in DeFi lending protocols.

Tectonic Crypto Exploit

The price that became borrowable money

The Cronos blockchain was halted after an exploit at Tectonic, its largest lending application, was estimated to have put roughly $75 million in assets at risk. The immediate cost was not only the suspected loss, but the suspension of all activity on the network. [4]

The risk was concentrated in a familiar DeFi assumption: that a token’s quoted price is a usable measure of collateral value. That is a financial risk, not merely a smart-contract risk, and it becomes acute when the token barely trades.

Tectonic operates as an onchain money market. Depositors place assets into lending pools, borrowers pledge collateral, and software permits borrowing up to a preset share of that collateral’s calculated value. The system needs a price at every step.

That calculated value is more important than the collateral token’s headline market capitalization. A lending protocol does not need a token to be broadly valuable in theory. It needs a reliable answer to a narrower question: what could this collateral be sold for now?

If the answer is wrong, a borrower can receive liquid assets against collateral that cannot realistically repay the debt. The loss then belongs economically to the lending pool, and therefore to depositors, unless another party makes it whole.

How a collateral factor works

Tectonic assigned its TONIC governance token a 20% collateral factor, according to the protocol’s published money-market parameters cited by The Block. In plain terms, $100 of accepted TONIC collateral could support up to $20 of borrowing. [4]

That figure may sound conservative. It is intended to create a buffer, allowing the collateral price to fall before a position becomes undercollateralized and subject to liquidation. Yet the buffer only works if the starting price has economic meaning.

A collateral factor is not a statement that the token is safe. It is a haircut applied to an external or onchain valuation. The protocol effectively says: take the reported value, then lend only a fraction of it.

The arithmetic is straightforward. If collateral value equals quantity multiplied by price, maximum borrowing equals that result multiplied by the collateral factor. A 20% factor means multiplying the reported collateral value by 0.20.

Consider an ordinary example. A borrower deposits 10,000 tokens priced at $1 each. The collateral value is $10,000. At a 20% collateral factor, the borrowing ceiling is $2,000, before other protocol limits and interest costs.

Now change only the price input. If a thin market is pushed from $1 to $100, the same 10,000 tokens appear to be worth $1 million. The nominal borrowing capacity becomes $200,000, although the underlying market may not support selling tokens near that price.

That difference is the core of an oracle or valuation-manipulation exploit. The attacker does not necessarily need to defeat cryptography, forge assets, or remove funds directly from a vault. They exploit the protocol’s willingness to lend against a distorted price.

What reportedly happened at Tectonic

Onchain researcher Weilin Li’s account, reported by The Block, was that an attacker pushed TONIC’s price roughly 100-fold in about 20 minutes, then deposited the inflated position as collateral and borrowed other assets. [4]

The reported scale illustrates why small decimal prices and enormous token quantities deserve attention. Li identified roughly 364.6 trillion TONIC in the attack position. At a reported price near $0.00000103 each, that position would be valued around $375 million. [4]

Apply Tectonic’s 20% collateral factor to $375 million and the borrowing capacity is approximately $75 million. That matches Li’s later estimate of assets received, after he identified an additional attacker-controlled address holding about $8 million. [4]

This calculation does not prove every detail of the attack. Tectonic had not confirmed the cause or the total affected amount when The Block reported the incident. The $75 million figure remains an onchain researcher’s estimate, not a final audited loss. [4]

Reports have also produced a wider range. Early estimates put the amount at about $66 million, while some coverage cited sums as high as $119.5 million. The variance matters because borrowed balances, wallet ownership and recoverable assets can change during an active incident.

The important point is not that TONIC briefly printed a high price. Markets produce volatile prices routinely. The issue is that the protocol reportedly converted a short-lived and low-liquidity price into a claim on more liquid assets held by other users.

Liquidity determines whether a price is credible

Liquidity is the cost of converting an asset into cash or another asset without moving its price sharply. A token can show a last-traded price, but that does not mean a holder could sell a large position at that price.

The independent research brief puts TONIC daily trading volume near $11,000 and available liquidity around $1.34 million before the incident. Against those numbers, a collateral valuation in the hundreds of millions should have demanded exceptional caution.

Thin liquidity makes price manipulation cheaper because relatively modest buying can move the marginal price, the price of the next token traded. That marginal price can be genuine for a tiny trade while being meaningless for valuing a very large collateral position.

This distinction is routine in conventional finance. A thinly traded microcap may have a visible quote, yet lenders and brokers commonly apply deep haircuts or refuse it as collateral. DeFi protocols encode comparable judgement in collateral factors and price-feed design.

Tectonic’s own documentation warned that low-liquidity assets can be vulnerable to price manipulation, according to The Block. The incident therefore appears less like an unforeseeable market event than a risk the system identified but did not adequately contain. [4]

Possible safeguards include excluding illiquid governance tokens entirely, setting borrowing caps that are small relative to exit liquidity, using time-weighted prices, and applying collateral factors that reflect stressed liquidation conditions rather than spot quotations.

None of those measures is costless. Restricting collateral reduces borrowing demand and fee revenue. Time-weighting can delay recognition of legitimate price moves. Conservative caps make a lending market less capital-efficient. The security decision is ultimately a pricing and credit decision.

A network halt contains loss, but does not erase it

Cronos validators halted the blockchain after identifying the Tectonic incident. According to reporting cited in the research brief, about $6 million was bridged to Ethereum before the halt, while the larger balance was prevented from leaving Cronos. [2]

That outcome shows a form of operational resilience, but it should be described accurately. The network did not automatically reverse an economic loss. Validators imposed an emergency stop, limiting the attacker’s ability to move assets while the investigation continued.

The same action carries costs for everyone using the chain. Users cannot transfer assets, settle trades, add collateral or repay loans while block production is halted. Other protocols connected to the network may also face disrupted pricing and liquidations.

It also exposes a governance fact often obscured by the word decentralized. A validator set capable of halting a chain can contain damage quickly, but it also has discretionary power over network availability and, potentially, decisions about frozen funds.

Cronos had not announced a restart timetable, a final loss total or a plan for the assets when the network resumed, according to The Block. There is likewise no confirmed percentage of customer funds recovered. [4]

The More Markets incident on Flow EVM provides a related, though mechanically distinct, warning. Blockchain security firm Blockaid said an attacker used Ankr Staked FLOW and Aave V3-style efficiency mode to overborrow about 15.5 million WFLOW, valued at $9.3 million. [5]

Efficiency mode increases borrowing power for assets expected to move together, such as a liquid-staking token and its underlying asset. It improves capital efficiency, but the safety of that extra leverage depends on the assumed correlation holding during stress. [5]

Coldcard shows the other side of the security problem

The Coldcard hardware-wallet exploit described by a Bitcoin Magazine panel at Bitcoin Asia 2026 involved a different trust assumption entirely. Rather than abusing a collateral price, the reported firmware flaw allowed private keys to be reconstructed from insufficiently random key generation.

A private key is supposed to be so unpredictable that guessing it is infeasible. The security of a hardware wallet is therefore not primarily its casing, offline status or interface. It begins with entropy, the unpredictable input used to create secrets.

The Bitcoin Magazine panel described a faulty fallback in the wallet’s random-number-generation path. Panel participants said the vulnerability had been present for years and potentially reduced the practical search space for affected keys dramatically, enabling theft without physical possession of a device.

Loss estimates remain incomplete. The independent research brief places confirmed losses around 1,778 bitcoin, while noting reports of more than $88 million in value and the possibility that total losses could exceed $150 million as investigators identify affected wallets.

Those numbers should not be converted into a definitive tally. Bitcoin’s price changes, reporting dates differ, and not every vulnerable wallet can be linked conclusively to theft. What is clear is that a failure at key creation bypasses every later custody precaution.

The contrast with Tectonic is useful. Tectonic reportedly accepted an unreliable market value as collateral. The Coldcard flaw reportedly created unreliable secrets. In both cases, the visible interface appeared to work while a foundational assumption beneath it failed.

Security claims are becoming governance questions

August’s reported exploit totals also show why security is moving beyond code audits. Cointelegraph cited DefiLlama data showing $139.7 million stolen in crypto hacks during August, including the Tectonic and More Markets incidents. [5]

Audits can identify implementation errors, but they cannot by themselves decide whether a token has enough liquidity to support a collateral market or whether governance parameters create excessive credit exposure. Those are ongoing risk-management choices.

Regulatory attention is moving in that direction. A 2026 CertiK report cited by Aju Press describes stronger expectations around smart-contract audits and anti-money-laundering controls, while the wider policy debate increasingly focuses on the identifiable parties operating or governing protocols. [3]

No specific new rule had been enacted in direct response to Tectonic or More Markets by August 31. Still, the practical lesson is already clear: code can execute a lending policy automatically, but people set the assumptions that determine who absorbs the loss.

Frequently Asked Questions

How did the Tectonic crypto exploit occur?

The exploit happened when an attacker artificially inflated the price of Tectonic’s TONIC governance token by about 100 times within 20 minutes. This inflated price was used as collateral to borrow assets far exceeding the real value of the tokens, exploiting the protocol’s reliance on token price as collateral value.

What caused the $75 million loss in the Tectonic exploit?

The loss stemmed from the protocol lending against an artificially inflated token price. Although Tectonic applied a 20% collateral factor, the inflated price multiplied by the large token quantity created a borrowing capacity of roughly $75 million, which the attacker drained.

How does collateral factor affect DeFi lending security?

A collateral factor limits borrowing to a fraction of the reported collateral value, intended as a buffer against price drops. However, if the reported price is artificially inflated or unreliable, the collateral factor does not prevent overborrowing, as it only scales the flawed valuation rather than ensuring true asset backing.

Why was the Cronos network halted after the Tectonic attack?

Validators halted the Cronos blockchain to contain the damage and freeze stolen funds on-chain. The halt limited further bridging of assets to Ethereum but also suspended all user transactions, leaving recovery uncertain and blocking normal network activity.

How we researched this

This article was assembled from 1 video source, 8 published articles, 5 cited references.

Nothing here is based on hands-on testing. Where a figure or finding appears, it belongs to the source cited beside it, and the writing says so rather than implying otherwise. Every source is listed below so you can check it.

Sources

Watch Crypto Network Security and Exploits on Youtube

Bitcoin-Backed Mortgages and Crypto Credit Lines Explained

Bitcoin-Backed Mortgages and Crypto Credit Lines Explained

Learn how Bitcoin-backed mortgages and crypto credit lines work, their collateral needs, risks, and custody details for U.S. borrowers.

XRP Surges 10% as SEC Drops Case: Ripple's Legal Victory and Market Impact

XRP Surges 10% as SEC Drops Case: Ripple's Legal Victory and Market Impact

XRP skyrockets 10% to $247 as SEC drops case against Ripple. Legal victory sets precedent for crypto industry. Ripple's $200M defense fund defends entire market. Altcoins surge; XRP in the lead. CryptosRUs teases DCA night livestream for more insights.

XRP Resilience: Potential US Reserve Inclusion Sparks Price Surge

XRP Resilience: Potential US Reserve Inclusion Sparks Price Surge

Discover how XRP defies the crypto market crash, with potential US strategic reserve inclusion. Ripple's partnerships and strategic moves hint at a bullish future for XRP's price.

XRP Surges to $340: Catalysts for Future Growth in 2025

XRP Surges to $340: Catalysts for Future Growth in 2025

XRP's potential shines as it reaches an all-time high of $340 in 2025. Regulatory clarity, institutional adoption, tokenization, and retail interest fuel optimism for XRP's future growth. Exciting times ahead for this crypto powerhouse.