The Cronos blockchain, associated with Crypto.com, was halted following an attack on the network’s largest lending protocol, Tectonic. The attacker manipulated the price of the illiquid token TONIC, driving it up by roughly 100 times within 20 minutes, and then took out $75 million in assets as over-collateralized loans. The mechanism is similar to the attack on Mango Markets in 2022.
Only about $6 million managed to be withdrawn via the bridge to Ethereum; the rest remained trapped in the halted network. Crypto.com’s CEO stated that the company’s app and exchange were not affected.
Similar attacks involving manipulation of illiquid tokens have recently occurred in other protocols as well: Moonwell on Base lost $8.7 million, and an attack on the Pendle market triggered liquidations worth $36 million on Morpho.
The protocol’s TVL dropped from $120 million to $3 million