Key Highlights
- Cronos resumed block production at 23:49 UTC on August 30 after validators halted the network over the Tectonic exploit.
- Validators restored the chain from a state snapshot taken before the Tectonic exploit.
- The attacker manipulated TONIC’s price and used the inflated token value as collateral to borrow other assets.
Cronos, the layer-1 blockchain developed by Crypto.com, resumed producing blocks late Sunday, after validators froze the network to contain an attacker from draining funds out of Tectonic, the chain’s largest lending protocol.
In a post on X Monday, the Cronos Network team confirmed the chain was producing blocks again and fully back online, calling the earlier shutdown a validator-coordinated emergency action to protect users from the Tectonic exploit.
Block production resumed at 23:49 UTC on August 30, starting fresh from block 90,896,189, with the chain’s state restored to how it looked before the attack. Node operators were told they could bring their systems back up on Cronos v1.7.8 using snapshots the team published that morning.
Recovery isn’t uniform across the ecosystem. Cronos said the network remains under observation while stability is confirmed, and that some protocols, RPC providers, explorers, and bridges built on top of the chain will take longer to come back than the base layer itself. A technical postmortem is still pending.
What led to the shutdown
The halt followed an attack on Tectonic on Sunday, August 30.
The attacker manipulated the price of TONIC, Tectonic’s governance token, driving it roughly 100 times higher within about 20 minutes despite the token’s limited trading liquidity, estimated at around $1.34 million.
The attacker then used the inflated TONIC price to deposit the token as collateral and borrow other assets from Tectonic’s lending pools, resulting in a significant outflow of funds.
Estimates of the losses vary depending on how the incident is measured. On-chain researcher Weilin Li, who first traced the attack, initially put the amount drained at around $66 million before revising the figure to approximately $75 million after identifying a second wallet linked to the attacker.
A separate analysis estimated $119.5 million in total outflows from Tectonic’s pools before accounting for liquidations and bad debt. Around $6 million of the affected funds reportedly crossed a bridge to Ethereum and was converted into ETH before Cronos halted the network, while the remaining funds stayed on Cronos.
Crypto.com CEO Kris Marszalek addressed the incident on Sunday, saying the company’s exchange and app were not affected and that customer funds on those platforms remained safe. The Cronos and Crypto.com security teams continued investigating the Tectonic exploit.
Users are asking what happens to their funds
The restart announcement drew a wave of questions from users trying to figure out where they stand.
Several people replying to Cronos’s update said funds they had on the chain had disappeared and asked whether the rollback would restore their balances.
Others pushed back on the idea of a blockchain being able to reverse transactions at all, arguing that a network capable of rolling itself back in an emergency is also one that could, in theory, be pressured to do so under other circumstances, a tension that tends to resurface whenever a chain intervenes like this.
Some users specifically asked what happens to positions and loans that were open on Tectonic itself, including deposits that had been earning interest and collateralized loans, since those were effectively frozen mid-state when the halt occurred.
What’s still unresolved
The core mechanics of the attack itself, and how Tectonic’s system allowed a low-liquidity token to be used as high-value collateral, haven’t been formally explained yet, something several users pointed out directly, noting that restoring the chain’s state is a cleanup step rather than a fix for whatever let the exploit happen in the first place.
Tectonic has said it will post a verified update once its own investigation is complete, and Cronos has committed to a fuller postmortem. Until those come out, the exact accounting of what’s recoverable, what’s lost, and how affected users will be made whole remains open.
Also Read: Float Protocol Losses 10.71 ETH After Uniswap V3 Spot Price Manipulation
