Cronos blockchain restarts after exploit by rolling back nearly two hours of transactions

The Cronos blockchain, a network built on the Cosmos SDK and supported by Crypto.com, resumed block production on Monday after validators rolled back its state to a point before an exploit on the Tectonic lending protocol. The move erased nearly two hours of transactions, including those of regular users, to undo the effects of the attack.

Chain rollback removes 10,961 blocks

Cronos halted at block 90,907,150 on August 30 at 14:32:47 UTC. Validators restarted the chain from block 90,896,189, discarding 10,961 blocks—about one hour and 54 minutes of activity. The network announced the restart at 9:31 a.m. ET on Monday, stating that block production resumed at 23:49:01 UTC on August 30. Node operators were instructed to use mainnet snapshots from 09:52:00 UTC that day.

A rollback reverses all transactions in the discarded blocks, not just those linked to the attacker. Cronos has not explained how it will handle legitimate user transactions, such as trades or transfers, that were undone.

Attacker moved $6.29 million to Ethereum

Security firm PeckShield tracked about $74 million across three addresses involved in the exploit, with roughly $6.29 million already bridged to Ethereum. Because Ethereum was not rolled back, these funds remain out of Cronos’s reach. Cronos noted that bridges and some other systems would take longer to restore but did not address how the shortfall from the bridged funds would be handled.

Loss estimates vary widely

Onchain investigator MASTR published an analysis suggesting the widely cited $74–$75 million figure is incomplete. By including additional funds tied to a contract deployed by the attacker 12 days earlier, MASTR estimated the gross outflow from Tectonic at about $119.5 million, with roughly $32.6 million in bad debt left in the protocol. The analysis also detailed the method used to manipulate Tectonic’s TONIC token price, which involved offchain price updates and transfers that inflated the token’s exchange rate without canceling the underlying debt.

Neither Cronos nor Tectonic has confirmed a final loss amount. Tectonic’s last public statement, issued on Sunday, acknowledged the incident and advised users not to interact with the protocol. It has not provided a reconciliation of losses or a plan for compensating affected users.

Market impact and ongoing issues

Following the exploit, the price of Cronos’s native token, CRO, fell 7.9% in 24 hours, while TONIC, the token involved in the manipulation, dropped 44.8%. Cronos’s total value locked—a measure of assets deposited in its decentralized finance protocols—declined by 13.4% to $228.75 million, according to DefiLlama. Tectonic’s locked value fell from $117.45 million on August 17 to $3.01 million.

Over 40 minutes after the restart announcement, some public infrastructure, including RPC providers and explorers, had not yet updated to the new chain state. Cronos warned that certain systems would take longer to come back online.

Why this matters

Chain rollbacks are rare and controversial because they reverse confirmed transactions for all users, not just attackers. This incident highlights the risks of price manipulation in decentralized lending protocols and the challenges of recovering funds once they leave the affected blockchain.

What happens next

Cronos stated that a full postmortem report would follow. The network has not yet detailed how it will address the undone transactions or the funds moved to Ethereum. Tectonic has not issued an update on user compensation or protocol recovery.

Sources

• The Defiant