Cronos validators roll back chain after estimated $75 million Tectonic exploit

Cronos validators restored the chain to its state before the Tectonic exploit. Cronos restarted block production from block 90,896,189 on Aug. 31. The block timestamp was 23:49:01 UTC on Aug. 30. Cronos said the network was fully back online. Cronos said some protocols, RPC providers, explorers and bridges could take longer to recover. Cronos said it was monitoring the chain for stability and would publish a full postmortem. The restart replaced an open-ended network halt with a monitored restart. Cronos had halted the wider blockchain on Aug. 30 after identifying the exploit at Tectonic, a decentralized lending protocol on the chain. Tectonic told users not to interact with the protocol until it confirmed that doing so was safe. Onchain researcher Weilin Li attributed the exploit to manipulation of TONIC, Tectonic's thinly traded governance token. Li said the attacker inflated TONIC's price and used it as collateral to borrow other assets from Tectonic. Tectonic's documentation lists a 20% collateral factor for TONIC in a parameter table dated May 2025. The historical table does not establish the configuration during the incident. Li first estimated that about $66 million was affected. Li later raised the estimate to roughly $75 million after identifying another attacker-controlled address. Li estimated that only about $6 million was bridged to Ethereum before Cronos halted. The figures and attack mechanism remain Li's assessment rather than an official accounting. Cronos said node operators could restart on version 1.7.8 using updated mainnet snapshots. Cronos did not specify how the rollback would affect transactions submitted during the discarded period. Cronos and Tectonic have not published a confirmed loss, an official root-cause analysis or a complete account of how attacker-controlled assets will be handled. Crypto.com CEO Kris Marszalek said the company's app and exchange were unaffected and operating normally. Marszalek said Crypto.com sent security staff to assist Cronos. His assurance applied to Crypto.com's services, not to Tectonic depositors. Connected-service recovery and the postmortem remain pending. Tectonic users have not been told when normal activity can resume.