Cronos rolled back nearly two hours of chain history
Cronos, the blockchain network backed by Crypto.com, erased close to two hours of transaction history after an exploit involving the Tectonic lending protocol, according to a post-mortem released Monday. The network said the rollback was used to reverse about $111.2 million tied to the incident and preserve most of the affected funds that were still on-chain.
According to Cronos developers, validators chose to reverse completed transactions to protect roughly 92% of affected funds still on the network. That step cut against the usual assumption that blockchain transactions are final once settled.
"It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk," the developers wrote. "Restoring state meant discarding 1 hour 54 minutes of settled transactions. The alternative, restarting without restoring state, would have left the borrowed assets in the attacker's control."
The network also made clear what that meant in practice: every legitimate transaction processed during that window was reversed along with the exploit-related activity.
How the Tectonic exploit unfolded
The post-mortem says the attack took place on Aug. 30 and targeted Tectonic, a lending protocol that allows users to borrow crypto against deposited collateral. Cronos said the attacker pushed up TONIC prices in low-liquidity decentralized exchange markets, then borrowed about $120.4 million across nine markets using the inflated collateral value.
Validators halted the network at 9:32 a.m. EST, according to Cronos, and then rolled back 10,961 blocks. That erased 1 hour and 54 minutes of transaction history.
"Every transaction in that window was reversed, whether or not it touched the exploit, and open positions on live apps repriced when trading resumed," Cronos wrote.
Even with the rollback, about $9.19 million had already left Cronos before the halt. The post-mortem says those funds have not been recovered and were outside the reach of the chain restore.
Cronos also contrasted its latest accounting with earlier estimates. Preliminary figures had put the affected value at $75 million and the amount bridged out at $6 million. The network's account now places the borrowing activity at $120.4 million, of which about $111.2 million was reversed.
Network restart came after about nine hours offline
Block production resumed at 6:49 p.m. EST on Aug. 30, the post-mortem says, after roughly nine hours of downtime. Validators went through several rounds of coordination before restarting the chain with patched software and the same transaction record.
Cronos acknowledged that communication during the shutdown was poor. It also said reversed transactions can now be checked through archived records rather than public blockchain explorers.
"We recognize the disruption this incident caused across the Cronos ecosystem," Cronos wrote. "With network operations restored, our focus remains on completing reconciliation with affected platforms and applying the lessons from this incident to strengthen ecosystem safeguards."
Other networks have faced similar choices
The report notes that Cronos is not the only crypto network to face a decision over halting operations or reversing transactions after an attack.
In August, Maya Protocol halted its network after an attacker exploited six software flaws and took about $1.65 million in crypto assets, according to the project. A separate vulnerability exploited on Ravencoin also led to efforts to rebuild that blockchain, putting roughly three days of transactions at risk of reversal.
Security experts have warned that AI may help attackers identify vulnerabilities faster, but the Cronos post-mortem does not provide evidence that AI played any role in the Tectonic attack.