PeckShield reported that an address tied to the Tectonic hack transferred 2,658.9 ETH, valued at $6.65 million, to Tornado Cash on September 3. The incident has drawn attention from exchanges and blockchain investigators, as the move represents one of the largest unrecovered sums following the Cronos network exploit on August 30.
Chain rollback leaves funds on Ethereum untouched
Tectonic, recognized as the leading lending platform on Cronos, experienced a major security breach that prompted validators to halt the blockchain within hours. Cronos, a blockchain network built by Crypto.com, later announced the restoration of block production from block 90,896,189, rolling the chain back to just before the hack.
Though the rollback reversed nearly all funds connected to the attacker within the Cronos chain, it could not reclaim assets already bridged to Ethereum. Approximately $74 million in stolen funds were traced by PeckShield across three addresses. Of this amount, $60 million remained in one Cronos wallet, $8 million in a second, and $6 million on Ethereum.
Independent data showed the Ethereum balance at 2,592.2152 ETH, or $6.29 million, after the incident. According to TRM Labs, the attacker moved stolen funds initially using USDC, then converted them into roughly 2,500 ETH.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLOn-chain researchers, including Weilin Li, used $75 million as the estimated total loss, while archive-node analyses suggested that up to $119.5 million may have been impacted if contracts deployed by the attackers before the exploit are included.
| Source | Total Stolen ($ Million) | Funds on Cronos ($ Million) | Funds on Ethereum ($ Million) |
|---|---|---|---|
| PeckShield | 74 | 68 | 6 |
| TRM Labs / Weilin Li | 75 | Unspecified | Unspecified |
| Archive-node analysis | 119.5 | Includes contracts | Includes contracts |
Price manipulation triggers catastrophic losses
Security firm TRM Labs explained that the attacker exploited TONIC, the native token of Tectonic, which had only $305,000 in weekly trading volume prior to the incident and a 20% collateral ratio. Halborn, a blockchain security company, found that the hacker artificially inflated the price of TONIC by nearly 100 times within 20 minutes, then used the overpriced token to borrow high-value assets from nine lending platforms.
Subsequent investigations revealed a second attacker’s wallet, raising the lost value estimate from $66 million to $75 million. The hack caused Tectonic’s total value locked (TVL) to plummet from $121.7 million to just $3 million, as tracked by DeFiLlama.
The attack on Tectonic hollowed out the platform, with TVL plunging more than $118 million within hours.
Tornado Cash remains the key laundering avenue
While the $6.65 million transacted via Tornado Cash represents a smaller portion of the overall exploit, the transaction route stands out due to Tornado Cash’s continuing role in crypto money laundering. TRM Labs documented that Tornado Cash received over $700 million in 2026 through June alone, making it the largest mixer protocol on Ethereum networks.
Besides being used to conceal illicit transactions, Tornado Cash has also supported legitimate privacy needs. The US Treasury removed the protocol from its sanctions list on March 21, 2025, but it remains under close watch for its role in facilitating major attacks.
The Cronos network’s rollback sparked a discussion about blockchain finality. Halborn emphasized that rolling back the chain limited losses but also undermined confidence in ledger immutability. Amid this uncertainty, CRO, Cronos’s native token, lost about 10% of its value in one day.
Mini dictionary: Tornado Cash, a decentralized privacy protocol on Ethereum, allows users to mix coins and obscure transaction trails, making it popular among both privacy advocates and cybercriminals seeking to launder assets.
Tornado Cash plays a pivotal role in laundering stolen cryptocurrency, remaining critically important to law enforcement, exchanges, and the wider crypto ecosystem.
Record rise in price-manipulation attacks
The Tectonic exploit mirrors a broader spike in price-manipulation attacks this year. PeckShield counted 50 major hacks in August alone, a 67% increase from July’s 30 incidents, though total losses decreased to $136.3 million from July’s $270 million. Among these, the Tectonic incident accounted for the largest loss of the month and ranked as the fourth-largest crypto theft in 2026.
TRM Labs has recorded 32 price-manipulation exploits so far in 2026, setting a new yearly record. Experts highlight that attackers often exploit low-liquidity tokens when protocols assign them significant collateral power, enabling rapid losses across protocols and networks.
The Tectonic case demonstrated how quickly such attacks can escalate, progressing from price manipulation to cross-chain laundering, and ultimately challenging the industry’s security and regulatory frameworks.
