Cronos, a Layer 1 blockchain built on the Cosmos SDK and backed by Crypto.com, went more than 10 hours without producing a block after halting itself on Sunday over an exploit at Tectonic, the lending protocol built on the chain, and researchers tracking the attacker’s addresses say roughly $68.7 million of the proceeds are still sitting on the frozen network. Only about $6.29 million got out before the pause, bridged to Ethereum and swapped into 2,592 ETH.

The measurement of the outage comes from Lookonchain, which published a Cronos explorer capture at 9:11 p.m. ET Sunday showing the network’s most recent transactions still sitting in block 90,907,150, timestamped “10 hrs 36 mins ago.” No block had been produced since. The chain’s status after that capture was not directly verified. Lookonchain put Tectonic’s loss at over $75 million.

“We identified an exploit in Tectonic,” Cronos Network wrote on Sunday. “The Cronos Network has been halted and we’ll provide updates here.” The two-sentence post named no loss figure, no mechanism and no restart time, and none has followed.

Tectonic told users it was “aware of an incident affecting Tectonic” and that its team was investigating. “As a precaution, please do not interact with the protocol until we confirm it is safe to do so,” it wrote.

The halt stopped everything, not just the compromised protocol. At 12:55 p.m. ET, Cronos ambassador who goes by Hajedan on X, wrote that the network was “still fully halted, making all Cronos protocols and applications being in a ‘paused state’ and not passing any transactions.”

The Cronos cryptocurrency, CRO, was down 9.3% in the past 24 hours.

Where the Money Sits

Security firm PeckShield flagged three addresses and put the total taken at about $74 million, saying the attacker “managed to bridge out only ~$6M to #Ethereum before the pause.” The portfolio captures published with its alert show $60,119,145 at one Cronos address — almost all of it a USDT/USDC liquidity position on the decentralized exchange VVS Finance — $7,775,589 at a second Cronos address, and $6,287,824 on Ethereum held as 2,592.2152 ETH.

Those balances are DeBank portfolio snapshots taken by the researchers when they posted. Hajedan, who read the same data from public RPC endpoints, says he is not part of the incident response, has no inside information and could be wrong on wallet attribution. He discloses that he is a Cronos ambassador.

The circulating totals differ because they count different things. PeckShield’s $74 million and blockchain researcher Weilin Li’s roughly $75 million are sums of balances the two located in attacker-controlled addresses. Hajedan counted gross borrowing instead: $124,963,890 across 16 Tectonic markets, priced at spot as of 10:32 a.m. ET, of which he said 99.91% of all borrowing on Tectonic in that window was the attacker’s. He traced roughly $110.5 million of that still on Cronos and about $7.8 million as unaccounted for. Neither Cronos nor Tectonic has confirmed any figure.

Collateral Valued at 1,568 Times Its Worth

Hajedan traced the attack to a single contract deployment at 8:38:56 a.m. ET, which ran the entire operation inside the constructor — the function that executes once, when a contract is created. “By the time it appeared in a block, it was already finished,” he wrote in his reconstruction. By roughly 9:07 a.m. ET, the extraction was over.

Two inflations ran at once. In 98 rounds, the attacker borrowed the entire cash balance of the tTONIC market and sent it straight back as a plain token transfer, which is not a repayment and so counted the same tokens twice, lifting the market’s exchange rate from 0.135406 to 1.085702 in a single block — an eightfold jump. At the same time, USDC borrowed from Tectonic minutes earlier bought TONIC in VVS pools, draining their TONIC reserves and pushing the oracle price Tectonic uses to value collateral up about 195 times at its peak.

“Multiply them and the collateral was valued at up to 1,568 times what it was really worth,” Hajedan wrote. Every loan then looked healthy to the protocol’s risk engine.

Li reached the same conclusion from a different direction. He attributed the root cause to TONIC’s 20% collateral factor — the maximum share of a deposit’s value that can be borrowed against it — combined with “very thin liquidity,” which he said allowed “a Mango-market style pump-and-borrow price manipulation attack” in which TONIC’s price “surged by 100x within 20 minutes.” He called it the third such attack recently, after Moonwell and reUSD.

A Token Worth Less Than the Loans It Unlocked

TONIC’s entire circulating market capitalization was about $8.09 million as of 3:49 a.m. UTC Monday, with a fully diluted valuation of about $13.1 million, according to CoinGecko — a fraction of the roughly $75 million researchers say was borrowed against it. The token shows an 85.4% 24-hour gain and an all-time high set on Aug. 30, the day of the attack, leaving it 99.18% below that peak; the manipulation spike sits inside the canonical price dataset.

Tectonic’s total value locked stood at about $3.0 million on Monday, down roughly 97% from about $117.4 million on Aug. 17, per DefiLlama. That measure tracks value leaving or being revalued inside the protocol rather than value stolen, and it also reflects the collapse in TONIC’s price after the spike.

Crypto.com, which built Cronos, said its own venues were untouched. “There has been a security breach on a Cronos lending protocol Tectonic,” chief executive Kris Marszalek wrote, adding that the Cronos team was investigating with help from the exchange’s security team. The Crypto.com “app and exchange were not affected and are operating as usual. All funds are safe,” he said, promising a thorough postmortem. That covers Crypto.com’s app and exchange, not deposits sitting in Tectonic.

Cronos has given no restart timetable. Neither the chain nor the protocol has confirmed a loss total, and neither has said whether Tectonic depositors will be made whole. The attacker’s remaining balances are, for now, stranded on a chain that is not moving.