Cronos Restarts Chain by Rolling State Back to Before the Tectonic Exploit

Cronos, a Layer 1 blockchain built on the Cosmos SDK and backed by Crypto.com, said on Monday morning that its network is producing blocks again, and that validators restored the chain's state to a point before the exploit that drained the Tectonic lending protocol on Sunday.

Rewinding a live chain undoes settled transactions for everyone who used it, not only the attacker. Cronos has not said what happens to the trades, transfers and liquidations other users made inside the window it discarded, and it has not addressed the roughly $6.29 million the attacker had already moved to Ethereum, where a Cronos rollback has no effect.

"The Cronos Network is producing blocks again and is fully back online," the chain’s official X account wrote at 9:31 a.m. ET. "This was a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol. The chain state was restored to before the Tectonic exploit from this morning."

The post said block production resumed at 23:49:01 UTC on Aug. 30, starting from block 90,896,189, and told node operators to restart on Cronos v1.7.8 using mainnet snapshots taken at 09:52:00 UTC on Monday. A full postmortem will follow, it said.

That resume timestamp sits nearly 13 hours before Cronos's own post at 8:43 a.m. ET Monday, 22 hours after the chain stopped, saying "We're still halted. Since the last update we've been working through the restart sequence with validators and security teams."

Almost Two Hours Deleted

Cronos stopped at block 90,907,150, timestamped 14:32:47 UTC on Aug. 30. That block was still the tip on two public endpoints, publicnode and drpc, when The Defiant queried them at 14:14 UTC Monday, with publicnode's Tendermint status reporting catching_up: false on the abandoned fork.

Restarting from block 90,896,189 drops 10,961 blocks. The last block indexed by the official explorer, 90,896,187, carries a timestamp of 12:38:52 UTC on Aug. 30, four seconds before the attacker's contract deployment, which Cronos ambassador Hajedan timed at 8:38:56 a.m. ET in his reconstruction of the attack. Everything the network processed from that point to the halt, one hour and 54 minutes of blocks, is gone.

Cronos has published no accounting of what was in them. Onchain investigator MASTR, citing an archive-node analysis, counted 752 liquidations that seized about $8.71 million from Tectonic users while the manipulated TONIC price was live, plus about $2 million taken by copycat bots that followed the attacker into the same markets.

The $6.29 Million Exception

Security firm PeckShield tracked about $74 million across three addresses on Sunday: roughly $60 million at one Cronos address, about $8 million at a second, and about $6 million bridged to Ethereum. Blockchain researcher Weilin Li put the total at about $75 million. Portfolio captures published with PeckShield's alert showed the Ethereum leg as 2,592.2152 ETH, worth $6,287,824 at the time.

Balances held on Cronos revert with the chain state. The ETH sits on Ethereum, which did not roll back. Cronos said bridges are among the systems that "will take longer to come back," and has said nothing about the shortfall a rollback leaves on the Cronos side of a bridge that has already paid out.

Bigger Than $75 Million

MASTR published an archive-node reconstruction on Monday that calls the widely repeated $74 million to $75 million range "materially incomplete if presented as the total amount removed from Tectonic." That figure counts assets sitting in a subset of attacker-controlled wallets, the analysis said. Adding about $43.7 million attributed to a contract the attacker deployed roughly 12 days before the incident brings the gross market outflow to about $119.5 million, with about $32.6 million in residual bad debt left inside the protocol.

The reconstruction puts the attacker's own capital at about 5 million USDC plus gas, and the gross economic gain at $114 million to $115 million at incident-time prices.

It also disputes the shorthand that the attacker simply pumped TONIC and deposited it. Tectonic's TONIC/USD feed was updated offchain and accepted a series of rising prices, while, in parallel, TONIC borrowed by one attacker account and sent into the tTONIC market as a plain transfer lifted the receipt token's exchange rate without canceling the debt behind it.

The final transaction pulled 55.24 million USDC, 45.65 million USDT, 98.04 WBTC, 1,895.10 WETH, 16.75 million CRO, 26.24 million LCRO and 270,650 XRP, according to the analysis. MASTR wrote the post before Cronos announced the restart.

Neither Cronos nor Tectonic has confirmed a loss figure.

Still on the Old Fork

Cronos warned that "some protocols, RPC providers, explorers and bridges will take longer to come back." More than 40 minutes after the announcement, none of the public infrastructure The Defiant checked had followed the chain to its new state. The official RPC at evm.cronos.org, VVS Finance's endpoint and evm-cronos.crypto.org each returned "no healthy upstream" with an HTTP 503. The two endpoints that answered were serving the abandoned fork. The official explorer counted 90,896,189 blocks in total and showed Sunday morning's blocks as its most recent.

CRO Down, TONIC Unwinds

CRO traded at $0.05548 at 14:12 UTC Monday, down 7.9% over 24 hours, for a market capitalization of $2.69 billion on 24-hour volume of $11.4 million, per CoinGecko. TONIC was down 44.8% on the day, with a market cap of $7.95 million, giving back the spike that set its all-time high during Sunday's attack.

Cronos's tracked total value locked stood at $228.75 million, down 13.4% over 24 hours, per DefiLlama. VVS Finance, the decentralized exchange whose thin TONIC pools the attacker moved, holds $184 million of that. Tectonic is at $3.01 million, against $117.45 million on Aug. 17.

Tectonic Has Not Posted

Tectonic's last statement is still Sunday's, telling users it was "aware of an incident" and asking them not to interact with the protocol. It has published nothing since — no market-by-market reconciliation of what its lending markets lost, and no word on whether depositors will be made whole.

Crypto.com chief executive Kris Marszalek has also not posted since Sunday, when he said the exchange's app and exchange were unaffected.

The attack repeats the pattern of the $8.7 million MAMO manipulation at Moonwell on Base last week, which Li cited when he called the Tectonic incident the third such attack in recent weeks. It also lands in a month of Cosmos SDK chain halts: MANTRA, TAC and KiiChain all stopped producing blocks in late August over a shared Cosmos EVM flaw, a bug unrelated to Tectonic's oracle and exchange-rate failure.