Cronos Network has released its formal incident report on the August 30 exploit of lending protocol Tectonic, confirming that an attacker borrowed roughly $120.4 million across nine markets against manipulated collateral, that a validator-led rollback reversed about $111.2 million, and that around $9.19 million had already been transferred off the chain before the halt and remains beyond recovery.
The official report was published at 01:15:39 UTC on September 8, 2026, nine days after validators stopped the chain to contain the attack, with an accompanying long-form article laying out the full technical timeline. It is the first time Cronos has put firm numbers to the amounts borrowed, reversed, and lost, and the first time the network has documented the exact block heights and duration of the discarded history.
Cronos is a Layer 1 (L1) blockchain associated with Crypto.com, with CRO serving as its native gas and staking asset. Tectonic is a decentralized money market that launched from the Cronos Labs incubator in December 2021 and was, before the incident, the largest lending market on the chain.
What the official timeline says
According to the postmortem, all times UTC on August 30, the attacker deployed contracts and began lifting the price of TONIC, Tectonic’s governance token, at 12:38:56 against thin liquidity on decentralized exchanges (DEXes). At 12:49:39, a single transaction borrowed approximately $120.4 million across nine Tectonic markets using the inflated TONIC as collateral. The Cronos team flagged irregular on-chain activity at 13:25:00 as liquidity began leaving the ecosystem. Validators halted the network at 14:32:47 at block 90,907,150.
After several rounds of coordination and a patched validator build, node operators agreed to restore state to block 90,896,188, described in the report as the last block produced before the suspicious activity began. Block production resumed at 23:49:01 UTC from block 90,896,189, returning affected balances to their pre-exploit state.
Those figures align with the restart notice Cronos posted on August 31, which gave the same resume time and restart height and instructed node operators to run Cronos v1.7.8 using snapshots dated 09:52:00 UTC that morning. Tuesday’s report adds the missing official money trail and the exact count of discarded blocks.
The rollback math
Cronos says roughly 92% of the affected value was still on the chain when validators halted block production. Restoring state reversed about $111.2 million. About $9.19 million, or 7.6% of the affected funds, had already left the network. The report says that slice “has not been recovered and is beyond the restoration’s reach.”
Two caveats belong next to those percentages. First, “affected funds” in the official text refers to the $120.4 million borrowing event, not to a court-tested loss, not to Tectonic’s total value locked (TVL), and not to the attacker’s net profit after costs.
Pre-incident dashboards cited in earlier reporting put Tectonic near $121.7 million in deposits and $82.7 million in loans, or about 46% of Cronos decentralized finance (DeFi). TVL prints collapsed after the incident, but that figure mixes withdrawals, liquidations, and price moves, so it is not a substitute for the official borrow, reverse, and outflow split.
Second, independent reconstructions during the first week never fully converged. Researcher paths ran from about $66 million to about $75 million. Pool-level outflow analyses reached $119.5 million to $120.4 million. CertiK’s August exploit tally listed Tectonic at $120.4 million, matching the borrowing figure Cronos now confirms. Estimates of how much left the chain before the halt clustered near $6 million in early researcher notes, with later on-chain tracing putting the bridged amount at about $8.3 million. The gap with the official $9.19 million is small relative to the rollback but is not reconciled in the report.
Why validators discarded 10,961 blocks
Cronos frames the rewind as a choice between finality and funds. Keeping the post-attack state, the report says, would have left borrowed assets under the attacker’s control. Restoring the last pre-activity block discarded 1 hour 54 minutes of settled transactions, or 10,961 blocks. The report is explicit that every transaction in that window was reversed, whether or not it touched the exploit, and that open positions on live applications repriced when trading resumed.
That is the part of the story that reaches past Tectonic depositors. Users who swapped, repaid, or opened a position inside the 114-minute band had that state erased. Cronos says discarded-fork blocks no longer resolve on public explorers, and it points independent researchers to archive snapshots.
The report also concedes a communication failure. “Communication during that window is where we can do better. Saving user funds took priority over updates,” the team wrote. It does not quantify how many unrelated transactions were reversed or specify how off-chain venues should treat deposits and withdrawals that referenced the discarded fork.
What is live, and what is not
Cronos says the chain has produced blocks continuously since 23:49:01 UTC on August 30. The block explorer is back, and indexers, subgraphs, and public remote procedure call (RPC) endpoints are described as fully operational. Most integrations have resumed, while some partners are still being restored.
Users are told that on-chain balances are back to their pre-incident state and that no action is required. The same section warns that recovery links and unsolicited direct messages should be treated as scams.
The unfinished work is off-chain. Exchanges, bridges, and other platforms still have to reconcile systems that may have credited or debited activity from the discarded window. Cronos has not published a list of those venues, a deadline, or a compensation policy for the $9.19 million that left the chain. The postmortem includes a disclaimer that the text is informational only, is not legal or financial advice, and does not constitute an admission of liability.
What Cronos says comes next
After reconciliation, the report lists three ecosystem items: a review of protocol risk management, especially collateral and pricing; stronger monitoring for unusual on-chain activity; and better coordination and incident response across the ecosystem.
Those points are consistent with the mechanism described in the report. The official text does not claim a novel smart-contract bug. It describes collateral-value manipulation and a single large borrow against thin TONIC liquidity, the same mechanism reported in the first 24 hours after the halt.
Whether Tectonic’s collateral factors, oracle sources, and listing rules were adequate for a thinly traded governance token is now an operational question for Tectonic and for every other Cronos lending market that prices illiquid assets. The postmortem does not publish those parameters as they stood on August 30.
Crypto.com’s exchange and app were described as unaffected in earlier company statements. That claim covers Crypto.com custody, not Tectonic depositors or users whose Cronos transactions sat in the discarded window. Tectonic is an independent protocol, Cronos is the underlying chain, and CRO is its gas and staking asset, three roles that should not be collapsed.
Also Read: Crypto Hacks Cross $322M in September’s First Week as Liquid Network Alone Loses $320M
