Crypto07 September, 20262 min read
Cronos Restores Tectonic After August 30 Exploit, Reverses $111.2M, $9.19M Still Missing
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Attacker borrowed about $120.4 million from Tectonic on Aug 30. $9.19 million escaped off-chain before validators halted the network.
Rollback After $120.4M Borrow
Cronos said its formal incident report on the August 30 exploit of the lending protocol Tectonic confirmed that an attacker borrowed roughly $120.4 million across nine markets using manipulated collateral. The report says validators halted the network at 14:32:47 at block 90,907,150 and then restored state to block 90,896,188, described as the last block produced before the suspicious activity began. Cronos reported that block production resumed at 23:49:01 UTC from block 90,896,189, returning affected balances to their pre-exploit state.
In that restoration, Cronos said it reversed about $111.2 million while around $9.19 million had already been transferred off the chain before the halt and remains beyond recovery. The report also said restoring the last pre-activity block discarded 1 hour 54 minutes of settled transactions, or 10,961 blocks, and that every transaction in that window was reversed whether or not it touched the exploit.
What Was Reversed, What Was Not
Cronos said the $9.19 million that left Cronos before the halt "has not been recovered and is beyond the restoration’s reach," even after the rollback reversed roughly $111.2 million in affected value. The report described the rollback as reversing every transaction within the discarded window, and it said open positions on live applications repriced once trading resumed under the restored state. Blockonomi summarized the same sequence, saying validators moved to halt network operations at 14:32:47 UTC, at block 90,907,150, aiming to limit further outflows while the situation was assessed.
Blockonomi also said "Every transaction within that window was reversed, regardless of whether it was connected to the exploit itself," and that blocks resumed at 23:49:01 UTC returning balances to their pre-exploit condition. Cronos added that discarded-fork blocks no longer resolve on public explorers, while archive node snapshots remain available for independent verification, and it said the chain explorer, indexers, subgraphs, and public RPC endpoints have since returned to full operation.
Timeline, Stakes, and Next Steps
Cronos’s post-mortem timeline described the attacker deploying contracts and lifting the price of TONIC at 12:38:56 against thin liquidity on decentralized exchanges (DEXes), followed by a single transaction at 12:49:39 borrowing approximately $120.4 million across nine Tectonic markets.
The report said Cronos flagged irregular on-chain activity at 13:25:00 as liquidity began leaving the ecosystem, and it said validators halted the network at 14:32:47 at block 90,907,150.
Crypto News quoted Cronos explaining the decision as "a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk," and it said the alternative would have left borrowed assets in the attacker’s control.
The Crypto Times also said the team conceded a communication failure, writing, "Communication during that window is where we can do better. Saving user funds took priority over updates," without quantifying how many unrelated transactions were reversed.
Looking ahead, Blockonomi said Cronos stated no action is required from users since balances were already returned to their prior state, while the team worked with exchanges, bridges, and other platforms to complete reconciliation.