Tectonic Finance Donation-Attack Exploit on Cronos — $120M Gross, $9.19M Net Loss

On August 30, 2026, an attacker executed a donation-attack style price manipulation against Tectonic Finance on the Cronos chain, beginning at 12:38:56 UTC and draining funds through 14:32:47 UTC, an 83-second gap between the final malicious batch and Cronos halting the chain. The gross amount manipulated was approximately $120.4M; roughly $74-75M was actually realized by the attacker across the drain, and Cronos's official post-mortem (published Sept 8) puts the confirmed net loss at $9.19M after accounting for a chain rollback to block 90,896,189. Cronos took the unusual step of rolling back the chain, reverting most of the exploit's transactions and recovering the bulk of user funds — a response distinct from most exploited chains, which do not reverse transactions. The attacker's funds were consolidated through a chain of intermediary contracts before reaching a final Ethereum destination address. Shortly after disclosure, scammers deployed a fake token contract designed to visually mimic the real destination address, an address-poisoning attempt targeting anyone trying to manually track the funds.