Cronos says it reversed about $111.2 million linked to the August 30 exploit of lending protocol Tectonic by rolling back its blockchain and deleting nearly two hours of transaction history. The move, detailed in a post-mortem from the Crypto.com-backed network, also wiped out legitimate activity processed during the same period.
According to Cronos, roughly $9.19 million had already left the network before validators halted block production and could not be recovered through the rollback. The incident highlights both the scale of the attack and the trade-offs the network accepted to preserve most of the affected funds that were still onchain.
How the exploit unfolded
Cronos said attackers manipulated TONIC, Tectonic’s token, on decentralized exchanges with limited liquidity. By pushing up the token’s price, the hackers were able to post inflated collateral and borrow approximately $120.4 million across nine markets on the protocol.
The network noted that earlier preliminary estimates had put the affected value at $75 million, with about $6 million believed to have been bridged out. In its post-mortem, however, Cronos said total borrowing activity tied to the exploit reached $120.4 million.
Validators erased 10,961 blocks
To contain the damage, validators halted the network at 9:32 a.m. EST on August 30 and later rolled back 10,961 blocks. Cronos said that amounted to 1 hour and 54 minutes of blockchain history being discarded.
Every transaction confirmed during that window was reversed, whether or not it had any connection to the exploit. Cronos said the rollback was intended to protect roughly 92% of the funds that were still on the network, even though the decision overrode the usual expectation that completed blockchain transactions are final.
What the rollback did and did not recover
Cronos said the rollback reversed about $111.2 million in exploit-related borrowing activity. At the same time, the action also nullified unrelated user transactions that happened to fall within the erased time span.
The network added that about $9.19 million had already left Cronos before validators stopped the chain, and that amount remains unrecovered. When trading resumed, live application positions were repriced, reflecting the effects of the chain reset and restart process.
Restart and remaining records
Block production resumed at about 6:49 p.m. EST on August 30, according to the post-mortem, after the network had been offline for roughly nine hours. Cronos said validators coordinated the restart using patched software while keeping the same transaction record.
Cronos also acknowledged problems in how it communicated during the shutdown. Because public blockchain explorers no longer show the discarded transactions in the normal chain view, the network said reversed activity can now be checked through archived records instead.
What comes next
The confirmed next step from Cronos is continued reliance on those archived records to review transactions that were removed by the rollback. Based on the post-mortem, the main known unresolved issue is the approximately $9.19 million that had already exited the network before the halt and was not recovered by the chain reset.
The episode leaves a clear factual record: Cronos chose to sacrifice nearly two hours of chain history, including valid user activity, to reverse most of the exploit’s impact onchain. That decision recovered a large share of the affected borrowing activity, but it also exposed the costs and limits of using a rollback as an emergency response.
Source: decrypt.co