Loading story…
Attackers exploited Tectonic, Cronos's largest DeFi lending protocol, by manipulating the thinly traded TONIC token price and tTONIC exchange rate used by its collateral oracle. The inflated collateral—reportedly valued at up to 1,568 times its actual value—was used to borrow liquid assets from protocol pools. Researchers put the attacker’s extracted value at roughly $74–75 million, while broader estimates of funds withdrawn reached approximately $120 million.
Cronos validators halted block production for more than 10 hours to contain the incident, freezing an estimated $68.7 million or more at attacker-controlled addresses alongside user assets on the network. Before the shutdown, the attacker bridged about $6.29 million to Ethereum and converted it into 2,592 ETH. Crypto.com said its app and exchange were unaffected; Cronos and Tectonic had not confirmed final losses, a restart schedule, or a remediation plan for affected depositors.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Cronos validators restarted the blockchain from a state preceding the Tectonic exploit, rolling back transactions and reversing an estimated $68.7 million to $69 million in proceeds that had remained on Cronos. Assets bridged to Ethereum before the halt could not be reversed by the rollback.
Cronos validators halted the Layer 1 network after detecting the attack on Tectonic, pausing all Cronos applications and freezing attacker-controlled funds as well as users' on-chain assets. The network subsequently produced no blocks for more than 10 hours.
Before Cronos was halted, the attacker bridged about $6 million to $6.29 million from Cronos to Ethereum, where the funds were swapped for approximately 2,592 ETH.
An attacker manipulated the thinly liquid TONIC market price and tTONIC exchange rate, then used inflated collateral to borrow assets from Tectonic. Researchers said the operation ran from about 8:38:56 a.m. to 9:07 a.m. ET and involved 98 borrowing rounds across Tectonic markets.
Following the Tectonic price-manipulation exploit and Cronos rollback, Tectonic's total value locked fell from approximately $122 million to less than $3 million.
Tectonic said it would reopen the protocol in phases, initially allowing withdrawals while keeping deposits and borrowing suspended. It also said it would publish a full postmortem of the incident later.
The attacker reportedly contacted whitehat activist @YannickCrypto on Discord and offered a 25% to 30% reward in exchange for cashing out the stolen funds.
Crypto.com CEO Kris Marszalek stated that the Crypto.com app and exchange continued operating normally, while acknowledging the breach affecting Cronos lending protocol Tectonic.
Tectonic advised users not to interact with its lending protocol while it investigated the exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
9 references tracked. Mallory keeps watching after this page renders.
halborn.com
Open sourcescworld.com
Open sourcemkd-cirt.mk
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcetrmlabs.com
Open sourcethedefiant.io
Open sourcexakep.ru
Open sourcedefillama.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Cosmos EVM balance-reconciliation flaw, tracked as `GHSA-7g4w-cg88-2cq2`, was exploited to drain assets from six Cosmos-based chains. The bug allows an unchecked underflow in a vesting account’s delegated balance to wrap to roughly `2^256`, corrupting reconciliation between EVM state and the Cosmos SDK `x/bank` module and enabling unauthorized minting or burning. Attackers reportedly sold about **$5.72 million** in affected assets through decentralized and centralized exchanges; KiiChain alone reported the theft of 148 million KII, valued at about $9.7 million at the cited price, while an attacker moved 2.99 billion TAC from a TAC account. Cosmos Labs released fixes in Cosmos EVM `v0.6.2` and `v0.7.2` and urged operators of affected public chains to coordinate upgrades or halt block production, as no configuration-only mitigation exists. MANTRA resumed operations using a patched `v8.4.0` binary, while TAC and KiiChain remained halted; KiiChain alleged that public availability of the state-breaking patch before private operator notification created an exploitable window and said two of three upstream defects were still unpatched. Blocking permissionless creation of vesting accounts removes the exploit precondition, but operators still need to deploy the patched releases.
Aug 30, 2026
Drift Protocol, a Solana-based decentralized trading platform, said attackers stole about **$280 million to $285 million** after a months-long intrusion culminated in the takeover of administrative control and the draining of protocol vaults in roughly 12 minutes. Drift’s preliminary findings said the operation abused Solana’s **durable nonce** feature and pre-signed transactions rather than a simple smart contract flaw, while investigators reported that the attackers staged activity weeks in advance, created a fake asset called **CarbonVote Token (`CVT`)**, and manipulated its trading history so protocol oracles would accept it as collateral. The stolen assets were then swapped largely into **USDC** and **SOL**, bridged to Ethereum through Circle’s Cross-Chain Transfer Protocol, and moved onward through additional services and exchanges.
Jul 1, 2026
Drift Protocol, a Solana-based decentralized exchange, lost roughly **$270 million to $286 million** after attackers seized its Security Council administrative powers and drained core vaults, prompting the platform to suspend deposits and withdrawals and warn users not to add funds. Drift later said the theft was not caused by a smart contract bug or leaked seed phrases, but by a sophisticated operation that abused Solana **durable nonce** transactions and pre-signed multisig approvals to execute malicious governance changes later. Investigators and Drift said the attackers removed withdrawal limits, introduced a fake collateral asset called **`CVT`** or CarbonVote Token, manipulated controls, and rapidly moved assets out of borrow/lend products, vault deposits, and trading funds, cutting the protocol’s total value locked from about **$550 million** to below **$250 million** and sending the **DRIFT** token sharply lower. Subsequent post-mortems described the breach as the culmination of a **months-long social-engineering campaign** in which the threat actors posed as a legitimate quantitative trading firm, built trust through conferences, Telegram chats, integrations, and deposits, and likely compromised contributors through a malicious code repository and a trojanized TestFlight wallet app. Blockchain intelligence firms including **Elliptic** and **TRM Labs** said the laundering patterns, cross-chain bridging from Solana to Ethereum, use of **Tornado Cash**, and other indicators were consistent with **North Korean** tradecraft, while Drift linked the operation with medium confidence to **UNC4736 / AppleJeus / Citrine Sleet**. The fallout widened beyond Drift as critics questioned why more than **$230 million in USDC** moved through Circle’s CCTP bridge without being frozen, Solana launched new security initiatives, and Drift later secured recovery backing including up to **$127.5 million from Tether** as it worked with security firms, exchanges, bridges, and law enforcement to trace and recover funds.
Jun 29, 2026