Image credit: Shutterstock
Cronos validators rolled the blockchain back to a point before the Tectonic exploit, reversing about $68.7 million in suspected proceeds that remained on-chain after an attacker manipulated the lending protocol’s TONIC collateral market.
The network restarted from block 90,896,189 at 23:49 UTC on August 30. The rollback discarded 10,961 previously produced blocks, removing the attack transactions alongside unrelated transfers, trades and other activity confirmed during the affected period.
Rollback Reverses $68.7M Still Held On Cronos
Blockchain analytics firm TRM Labs estimates the attacker borrowed about $75 million from Tectonic before validators halted Cronos.
Roughly $6 million had already been bridged to Ethereum and could not be reversed through the rollback. The remaining $68.7 million was still on Cronos when validators stopped block production and was removed from the canonical chain when the network restored its earlier state.
Cronos described the halt as an emergency action agreed through validator consensus. The network is producing blocks again while infrastructure providers continue synchronizing with the restored chain.
TONIC Reportedly Rose 100-Fold Before $75M Was Borrowed
The exploit centered on Tectonic’s TONIC governance token, which had relatively little trading liquidity but could be supplied as collateral. The attacker reportedly pushed TONIC’s market price roughly 100-fold within about 20 minutes, deposited the inflated tokens and borrowed more liquid assets against them.
TRM said TONIC recorded only about $305,000 in trading volume during the week before the exploit, highlighting the limited liquidity behind the manipulated collateral. Tectonic has not published a final loss figure or complete technical postmortem.
Cronos Rollback Removes 10,961 Blocks of Confirmed Activity
The response went beyond freezing attacker-controlled addresses. Restoring Cronos to its pre-exploit state meant transactions previously accepted by validators were removed from the canonical chain.
Node operators were instructed to restart using Cronos version 1.7.8 and updated network snapshots. Some protocols, bridges, explorers and RPC providers required additional time to synchronize after the restart.
Cronos has promised a full postmortem covering the incident and recovery process, including the rollback decision and handling of the affected chain state.
