Tectonic said in an incident report that $9.19 million remains unrecovered after attackers exploited the Cronos-based lending protocol on August 30 by manipulating the price of its TONIC governance token and using the inflated valuation as collateral.

According to the report, the attackers borrowed TONIC and then re-deposited it as collateral within the same transaction. Tectonic said that setup, combined with spot pricing, a 20% collateral rate and missing controls tied to market depth and rapid price increases, allowed the token’s value to be artificially inflated inside the protocol.

Using that inflated collateral valuation, the attackers borrowed nominal assets worth $120.4 million across multiple markets. Tectonic drew a distinction between that nominal borrow figure and the amount that actually left the system before emergency action was taken.

Cronos then paused the network and rolled back the state, according to Tectonic. Before that pause, the attackers had already withdrawn about $9.19 million across chains, and that amount has not yet been recovered.

Tectonic said it plans to gradually remove low-liquidity tokens from the list of eligible collateral assets and add borrowing limits. The protocol did not provide implementation details or a timeline, saying those will be announced after the plan is finalized.

The team also said it is working with forensic agencies, law enforcement, stablecoin issuers, exchanges and cross-chain bridges in an effort to recover the missing funds. No further operational details were disclosed in the report.

Why It Matters

The incident puts focus on a persistent DeFi lending risk: collateral frameworks can fail when low-liquidity assets, spot pricing and weak position limits interact in the same market design. In this case, the exploit was not described as a traditional smart-contract drain alone, but as a breakdown in collateral risk controls that let nominal borrowing expand far beyond realistic market depth.

It also matters for Cronos because the response involved a network pause and rollback, alongside protocol-level remediation. That combination raises broader questions about how ecosystem operators balance user protection, market integrity and decentralization when a lending failure spills into cross-chain withdrawals.