At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend. 

The decentralized lending platform confirmed on Sunday morning that it was dealing with a security incident, and the public blockchain Cronos halted activity to prevent an outflow of stolen funds. 

The fraudsters were able to jack up the price of Tectonic’s thinly traded coin to more than 100-times its original price in the span of 20 minutes. They then used the Tonic tokens, with their newly inflated price, as collateral in order to borrow assets against them — attempting to make off with an estimated $74 million, according to blockchain security firms.  

While more than $6 million left the platform, about $68 million was stopped from leaving and is still on the Cronos blockchain. 

Kris Marszalek, CEO of Crypto.com — the company behind Cronos — said they are assisting in the investigation and noted their platform was not affected by the incident. On Monday, Cronos explained that it is back online and told customers that it made the emergency decision to shut the platform down “to protect users from an exploit on the Tectonic protocol.”

“This was deemed necessary as it protected users from being exposed to this exploit,” Cronos CEO Ryan Wyatt said. 

Crypto.com and Cronos did not respond to requests for comment about what will happen to the funds that were frozen on the platform. Blockchain security company TRM Labs claimed Cronos “restored” its system back to the state it was in before the attack, thus “reversing” the nearly $69 million that was still on the platform.  

TRM Labs said the rollback was visible on the blockchain. It had no impact on the $6 million that had already left the platform, and it is unclear whether the company will negotiate with the hacker. 

Tectonic said it plans to reopen in phases, initially allowing withdrawals while keeping borrowing and depositing activity paused. The company said it will release a full postmortem on the incident at a later date. 

As of Monday, it was unclear who launched the attack against Tectonic. 

Experts compared the incident to one that impacted cryptocurrency trading platform Mango Markets in 2022 — where a fraudster borrowed funds, artificially raised the price of a coin and then offloaded the funds, eventually pocketing the difference. The man behind that incident was eventually arrested and convicted of commodities fraud, commodities market manipulation, and wire fraud.

The attack on Tectonic comes days after a similar incident impacting the Moonwell platform involved losses of about $8.7 million worth of cryptocurrency. 

Ari Redbord, global head of policy at TRM Labs, said the industry has seen an increase in market manipulation attacks, where an attacker moves the price of a token and then borrows against that inflated price.

"These are now one in eight crypto hacks, up from one in 17 in 2022, with 32 incidents so far this year,” Redbord said. “The vulnerability is in how protocols value collateral.”