Cronos Rolls Back the Clock, But $9.19M Already Clocked Out 🕰️

Cronos confirmed that $9.19 million in crypto left its blockchain before validators halted the network during the Aug. 30 exploit of lending protocol Tectonic, according to the project's post-mortem report. The amount transferred off Cronos exceeded the $8.3 million previously traced to Ethereum by blockchain data provider Bitquery and the $6 million cited in preliminary estimates.

According to Cronos, manipulated collateral values generated about $120.4 million in borrowing activity. Validators halted the network at 14:32:47 UTC after Tectonic detected suspicious activity at 12:49 UTC, then rolled back 10,961 blocks to reverse 1 hour 54 minutes of settled transactions and restore roughly $111.2 million, or about 92% of affected funds still on the network. Block production resumed at 23:49:01 UTC after balances were restored.

"It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk," Cronos' devs wrote. "Restoring state meant discarding 1 hour 54 minutes of settled transactions. The alternative, restarting without restoring state, would have left the borrowed assets in the attacker's control." The rollback reversed every transaction processed during that window, including legitimate ones, and open positions on live apps repriced when trading resumed.

Cointelegraph previously reported that one transaction emptied nine Tectonic lending markets through 11 transfers involving stablecoins, $BTC, $ETH and other assets. Bitquery said the attacker deposited $5 million, then repeatedly borrowed and redeposited TONIC through a 98-cycle loop while purchasing the thinly traded token. The activity drove TONIC's price nearly 300-fold higher as Tectonic's price feed followed.

The disclosure confirms the scale of the incident after earlier estimates placed the amount affected at about $75 million. Cronos acknowledged poor communication during the shutdown and said reversed transactions can now be checked through archived records rather than public blockchain explorers. "We recognize the disruption this incident caused across the Cronos ecosystem," Cronos wrote. "With network operations restored, our focus remains on completing reconciliation with affected platforms and applying the lessons from this incident to strengthen ecosystem safeguards." Other networks have faced similar decisions about halting operations or reversing transactions after attacks, including Maya Protocol, which halted its network in August after an attacker exploited six software flaws and took approximately $1.65 million in crypto assets.