Tectonic hit by oracle manipulation attack, $120.4 million in assets stolen

TechFlow reports that on September 8, according to an official post-incident report released by Tectonic, Tectonic, the lending protocol on the Cronos chain, was targeted by an oracle manipulation attack on August 30, 2026, at 12:49 UTC. The attacker inflated the TONIC collateral valuation by approximately 195 times by looping the borrowing and re-collateralization of TONIC tokens 98 times within a single transaction. Leveraging the artificially inflated collateral value, they subsequently borrowed assets with a notional value of $120.4 million from nine lending markets, including multiple assets such as USDC, USDT, WBTC, and WETH.

The attacker bridged the stablecoins to Ethereum and exchanged them for ETH, while selling the remaining assets for CRO on the Cronos chain before transferring them out. Approximately $9.19 million successfully escaped before the network was halted. At 14:32 UTC, Cronos validators emergency-paused the network, rolling back the on-chain state to pre-attack conditions, thereby recovering assets still held on Cronos. Currently, Tectonic’s supply and lending features remain suspended, while withdrawal and repayment functionalities continue to operate normally. Tracking operations for the stolen funds are underway through collaboration between blockchain forensics firms, law enforcement agencies, and stablecoin issuers, with freeze requests already submitted to the respective issuers.