Tectonic attacker moves escaped ETH into Tornado Cash

According to PeckShield, the address associated with the Tectonic hack sent approximately 2,658.9 ETH, equivalent to $6.65 million, into Tornado Cash on September 3, UTC time. This transaction is a significant part of the money that was unrecovered by Cronos after validators rolled back the chain after the incident on August 30.

The destination is important much beyond Cronos. Tornado Cash is still the biggest mixer in Ethereum-based networks and this makes the transaction of interest to exchanges, investigators and traders who trace stolen cryptocurrency.

The only money the rollback could not touch

When Tectonic, the largest lending platform of Cronos, was depleted on August 30, validators brought the network to a halt in less than no time. Cronos claimed afterwards that it restored the chain to the point prior to the attack and resumed block generation from the block number 90,896,189.

The rollback erased nearly all balances associated with the attacker on Cronos but it could not reverse any funds that had already made their way to Ethereum.

According to PeckShield, approximately $74 million in stolen funds can be followed through three addresses, of which $60 million could be found in one of the Cronos wallets, $8 million in the second one, and $6 million in Ethereum.

As reported by The Defiant, at the time, the Ethereum balance reached 2,592.2152 ETH, which converted into $6.29 million. The data provided by TRM Labs indicated that the hacker initially moved those funds off Cronos by means of USDC before converting them into about 2,500 ETH.

For this article, the figure of $75 million is used based on what is reported by TRM Labs and on-chain researcher Weilin Li. Peckshield’s figure of around $74 million is the rounded-up value of the funds from the three tracked addresses. 

Whereas, the figure of $119.5 million is a result of a larger archive-node reconstruction that includes the contract set up by the hackers before the exploit took place.

A 100x pump that hollowed out Cronos’s biggest lender

The attack targeted a token that lacked significant depth in the market. TRM Labs stated that TONIC only had $305,000 in trading volume in the week before the hack, although it had a 20% collateral ratio.

According to Halborn, the hacker increased the price of TONIC by around 100 times within 20 minutes and used the inflated version of the token to leverage harder assets from nine lending protocols.

Earlier reports by Cryptopolitan indicated that the estimated amount of funds lost had increased from approximately $66 million to around $75 million once a second attacker’s wallet was found by Li. Tectonic total value locked (TVL) dropped from approximately $121.7 million before the hack to around $3 million, according to DeFiLlama.

Why a $6.65 million deposit ripples past Cronos

The Tornado Cash deposit is small compared with the broader crypto market, but its route is significant. TRM Labs reported that Tornado Cash had received more than $700 million in 2026 by June and remained the largest mixer on Ethereum-based networks.

TRM has also documented its use by ransomware groups, cybercriminals and North Korea’s Lazarus Group, while noting that the protocol has legitimate privacy uses. The US Treasury removed Tornado Cash from its sanctions list on March 21, 2025.

Cronos’s response raised another issue: finality. Halborn said the rollback reduced the damage but came with a cost to confidence in ledger immutability. Cryptopolitan reported CRO falling about 10% over 24 hours during the initial fallout, while CoinMarketCap later linked continued weakness to the exploit, halt and rollback.

A record year for price-manipulation attacks

Tectonic fits a broader security trend. PeckShield counted 50 major hacks in August, up 67% from July’s 30, although total losses fell 49.5% to $136.3 million from $270 million. Tectonic was August’s largest incident and ranked as the fourth-largest crypto theft of 2026 at the time.

TRM Labs says price-manipulation exploits have already reached an all-time high in 2026, with 32 recorded so far.

The weakness is not always faulty code. When thinly traded collateral is given meaningful borrowing power, attackers can target the price a protocol trusts. Tectonic shows how quickly that risk can spread—from an illiquid token, to a lending protocol, to a chain rollback, and eventually into the cross-chain laundering ecosystem.

 

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.