Cronos has restarted block production after validators carried out an emergency halt during an exploit involving the Tectonic protocol and then restored the chain to a state from before the attack.

The network resumed from block 90,896,189 at 23:49:01 UTC on Aug. 30. Node operators were told to restart with Cronos v1.7.8 and the latest mainnet snapshot dated Aug. 31 at 09:52 UTC.

Chain brought back online

Cronos said the blockchain is now fully back online following the coordinated restart. Even so, the project cautioned that service recovery may not happen at the same pace across the ecosystem, with bridges, RPC providers, explorers and some protocols potentially taking longer to return as operators complete their own checks.

The restart followed a rollback that reset the chain state to a point before the exploit. As a result, transactions that took place during the affected period were removed from the history of the restarted chain.

Why validators halted the network

According to the project, validators stopped block production as an emergency consensus action meant to protect users while the incident was investigated. The halt was triggered by an exploit targeting Tectonic, a protocol on Cronos.

Initial findings cited in the report pointed to manipulation involving TONIC, Tectonic’s governance token. Based on those findings, the attacker allegedly pushed TONIC’s price higher and then used the inflated token as collateral to borrow other assets.

Estimated impact and fund movement

Onchain data estimated that roughly $75 million was affected by the incident. The article said some of the assets had already been bridged to Ethereum before validators halted the network, although most of the assets were still on Cronos at the time.

Cronos also said Crypto.com’s app and exchange were not compromised. The company’s security team assisted with the investigation into the exploit and the subsequent response.

What comes next

Cronos said a full postmortem will be released soon. That report is expected to cover the exploit itself, the reasoning behind the emergency response, and the technical details of the restart process.

For now, the confirmed next step is continued service restoration by infrastructure providers and protocols that depend on the network, alongside the forthcoming incident review from the Cronos team.

Source: crypto.news