Cronos Says $9.19 Million Is Unrecovered After Tectonic Exploit

• Cronos confirms $9.19 million escaped the network before validators halted transactions following the Tectonic exploit.
• The rollback reversed approximately $111.2 million and discarded nearly two hours of transaction history.
• An attacker manipulated TONIC collateral to borrow $120.4 million across nine lending markets.

Cronos (CRO) says $9.19 million transferred off-chain during the August 30 Tectonic exploit is still unrecovered. Validators reversed approximately $111.2 million through a rollback, restoring affected balances to their earlier state.

The September 7 post-mortem puts total borrowing linked to the attack at $120.4 million. It also details the cost of restoration: nearly two hours of transaction history disappeared, including legitimate user activity.

Cronos rollback reverses balances but erases user transfers

Cronos reports that the decision discarded 10,961 blocks covering one hour and 54 minutes. The reversal affected every transaction within that window, regardless of any connection to the attacker.

Validators weighed users’ expectations of transaction finality against the assets still exposed. Restarting without restoring balances would have left the borrowed funds under the attacker’s control, the team said.

However, the chain rollback could not reverse transfers already completed outside the network. Those assets account for roughly 7.6% of the total affected value.

TONIC collateral manipulation enabled borrowing across markets

The attacker deployed contracts to inflate the market price of TONIC, Tectonic’s thinly traded governance token. About 10 minutes later, inflated collateral supported $120.4 million in borrowing across nine markets.

Cronos identified malicious activity roughly 36 minutes after the attack began. Block production resumed around 11 hours after the initial attack, following the restoration.

Meanwhile, exchanges, bridges and other connected platforms continue reconciling their records with the restored chain. Cronos says users need no action at this stage.

The block explorer, public RPC endpoints, indexers and subgraphs are operational again. These services provide transaction records and network access for users and applications.

The post-mortem does not identify the attacker or explain how the unrecovered $9.19 million will be addressed.