Cronos Rolls Back Chain After $120.4M Tectonic Exploit, $9.19M Remains Unrecovered

Cronos reversed nearly two hours of blockchain history following the Aug. 30 Tectonic exploit, restoring balances tied to about $111.2 million of the incident’s $120.4 million exposure. 

Another $9.19 million had left the network before validators stopped block production and was therefore outside the scope of the rollback.

The Crypto.com-associated Layer 1 blockchain detailed its response in an incident review published Monday. According to Cronos, the exploit affected nine Tectonic lending markets and resulted in approximately $120.4 million being borrowed. 

Cronos Returns Chain to Pre-Exploit Checkpoint

Instead of continuing from where the network had been paused, validators resumed Cronos from block 90,896,188. Cronos described that height as the finalized checkpoint immediately preceding the exploit.

Restoring that earlier version of the ledger reversed changes associated with roughly $111.2 million in affected assets. However, the rollback was limited to activity recorded within the portion of the chain that was replaced. 

By the time validators suspended the chain at block 90,907,150, assets worth $9.19 million had already been moved beyond Cronos. The outstanding amount represents 7.6% of the total value affected by the exploit. 

Cronos said validators faced a choice between preserving the chain state recorded when block production stopped and recovering assets still exposed to the exploit. Continuing from the later state, according to the incident review, would have preserved the unauthorized borrowing rather than reversing it.

The recovery had consequences beyond the exploit itself. To restore the network to its pre-attack state, validators moved the chain back by 10,961 blocks, effectively reversing nearly two hours of blockchain history. That action also nullified activity processed within the reverted window, including transactions entirely unrelated to the Tectonic incident.

TONIC Price Manipulation Preceded $120.4M in Borrowing

Cronos said the exploit began after new contracts were deployed and TONIC’s market price surged sharply. TONIC is Tectonic’s governance token, and its relatively thin liquidity allowed the price movement to substantially increase the apparent value of the collateral being used in the protocol. 

Around 10 minutes after the manipulation began, the inflated collateral value was used to obtain approximately $120.4 million in loans across the affected markets. 

Roughly 36 minutes into the incident, the unusual on-chain behavior came to Cronos’ attention. Validators subsequently paused the network, stopping new block production while the teams involved coordinated their response.

Block production remained offline for approximately 11 hours before Cronos resumed operation from the earlier finalized checkpoint. 

Exchanges and Infrastructure Providers Reconcile Restored Chain

Bringing the blockchain back online did not immediately resolve the disruption for platforms connected to Cronos. The network said it continues to coordinate with exchanges, cross-chain bridges, and other affected service providers as they reconcile their systems with the restored ledger.

For users, Cronos said no action is currently necessary. Its blockchain explorer is accessible again, while public RPC infrastructure, indexing services, and subgraphs are functioning. 

Cronos’ incident review did not attribute the exploit to a named individual or group. It also left unresolved the ultimate recovery prospects for the $9.19 million that moved beyond the portion of blockchain history validators could reverse.