The two published pieces of the loss add up to the bottom of the published range. About $60M stranded on Cronos plus about $6M reportedly bridged to Ethereum is $66M, and the upper estimate is $75M [3][2][1], so somewhere between nothing and roughly $9M is either double-counted, still being marked at manipulated prices, or somewhere nobody has pinned down yet. The direction of that reconciliation is the whole story, because $60M out of $66M is 91% contained and $60M out of $75M is 80% [2]; that ten-point spread is the difference between a circuit breaker that worked and one that mostly worked.
Then there is the rate. A hundredfold move in about twenty minutes [1] is a price doubling every three minutes [3]. That speed says more about the book the attacker was trading into than about the attacker himself: an oracle reading spot on a token that thin has nothing to compare the print against. Tectonic's oracle apparently took it as legitimate, and the attacker walked out with the stable, liquid assets while the protocol kept the TONIC [4]. Researcher Weilin Li put it in the mold of Mango Markets, where Avraham Eisenberg drained over $100M from a Solana protocol in October 2022 and was later convicted of commodities fraud [5][6]; the Tectonic take is two-thirds to three-quarters of that [4], on a playbook that has now been prosecuted to verdict.
CRO rose 4-5% afterwards, which the publisher reads as the market pricing in containment [8]. Fair enough, but notice what got priced. It wasn't a repaired oracle, and Tectonic isn't a protocol that had never wobbled before, it had smaller logic problems in its past [13]. What got priced is the availability of a discretionary stop, attached to a Tendermint validator set capped at 100 that agreed within minutes [7], and cryptobriefing is explicit that the containment was only possible because that set is small [9]. A set small enough to agree in minutes on stopping a theft is a set small enough to be asked to agree on other things, and the bill for the stop went to everyone: every unrelated transaction, contract and DeFi position on Cronos stopped as well [10].
This is probably wrong, but my read is that the $60M is a hostage rather than a recovery until someone publishes how block production resumes without also resuming the attacker's balance, and the Eisenberg precedent that manipulation can be criminal even when the code permitted it [11] is the actual lever here, because it gives Tectonic a counterparty with something to lose. This goes one of three ways: a negotiated return under that legal pressure, a restart in which the funds move anyway, or a validator-level freeze that reaches into balances and makes the decentralization question explicit rather than implied. What would prove me wrong is a restart where the money is already immobilised at the contract level, in which case the halt bought time and nothing more contentious than that.
