Tectonic attacker activity resurfaced after a wallet tied to the exploit transferred 2,658.9 ETH into Tornado Cash on September 3 UTC, according to PeckShield.
The deposit, worth $6.65 million, represented funds Cronos validators could not recover after reversing the August 30 attack.
Cronos validators halted the network and restored the chain to a point before the exploit, resuming block production from block 90,896,189. The rollback removed nearly all attacker-linked balances on Cronos, but it could not reverse assets already bridged to Ethereum.
Cronos Rollback Leaves Ethereum Funds Unrecovered
PeckShield tracked about $74 million in assets across three addresses, including $60 million in one Cronos wallet, $8 million in another, and $6 million on Ethereum. The Defiant reported the Ethereum balance at 2,592.2152 ETH, then worth about $6.29 million.
TRM Labs said the attacker moved funds from Cronos using USDC before converting them into about 2,500 ETH. The $75 million loss estimate is based on TRM Labs and on-chain researcher Weilin Li. PeckShield’s roughly $74 million figure reflects rounded balances across the three tracked addresses.
A broader archive-node reconstruction produced a $119.5 million figure because it also included a contract created before the exploit.
TONIC Price Manipulation Drains Tectonic Liquidity
TRM Labs said TONIC recorded only $305,000 in trading volume during the week before the attack despite carrying a 20% collateral ratio. Halborn reported that the attacker pushed TONIC’s price roughly 100 times higher within 20 minutes, then used the inflated token to borrow harder assets from nine lending protocols.
The estimated loss rose from about $66 million to around $75 million after Li identified a second attacker wallet. DeFiLlama data showed Tectonic’s total value locked falling from about $121.7 million before the hack to roughly $3 million afterward.
Tornado Cash Transfer Highlights Wider DeFi Security Risks
TRM Labs reported Tornado Cash had received more than $700 million in 2026 by June and remained the largest mixer on Ethereum-based networks. It documented use by ransomware groups, cybercriminals and North Korea’s Lazarus Group, while noting legitimate privacy uses. The US Treasury removed Tornado Cash from its sanctions list on March 21, 2025.
Halborn said the rollback reduced damage but carried a cost to confidence in ledger immutability. CRO fell about 10% over 24 hours during the initial fallout, while CoinMarketCap later linked continued weakness to the exploit, halt and rollback.
PeckShield counted 50 major hacks in August, up 67% from July’s 30, while total losses fell 49.5% to $136.3 million from $270 million. Tectonic was August’s largest incident and ranked as the fourth-largest crypto theft of 2026 at the time.
TRM Labs said price-manipulation exploits had reached an all-time high in 2026, with 32 recorded so far. The Tectonic attack showed how thin collateral, oracle pricing, chain finality, and laundering routes can converge when illiquid tokens receive meaningful borrowing power.
