Cronos, the Crypto.com-backed blockchain, deliberately erased nearly two hours of transaction history to recover approximately $111.2 million drained in an exploit of DeFi lending protocol Tectonic, according to a post-mortem the network published on Monday.
What Happened
On August 30, attackers targeted Tectonic, a platform that allows users to borrow cryptocurrency against deposited collateral. According to the post-mortem, the attacker artificially inflated the price of TONIC tokens in decentralized exchange markets with thin liquidity, then used the overvalued collateral to borrow approximately $120.4 million across nine separate markets.
Cronos validators halted the network at 9:32 a.m. EST and rolled back 10,961 blocks, erasing 1 hour and 54 minutes of settled transactions. Block production resumed at 6:49 p.m. EST the same day, leaving the chain offline for roughly nine hours. Validators required multiple rounds of coordination before restarting with patched software.
The Rollback’s Cost
The intervention protected approximately 92% of the affected funds still sitting on the network, but it came with collateral damage. Every transaction processed during that window was reversed, regardless of whether it had any connection to the attack.
‘It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk,’ Cronos developers wrote. ‘Restoring state meant discarding 1 hour 54 minutes of settled transactions. The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.’
‘Every transaction in that window was reversed, whether or not it touched the exploit, and open positions on live apps repriced when trading resumed,’ the post-mortem added.
What Remains Unrecovered
Approximately $9.19 million had already left the Cronos network before validators could halt it, placing those funds beyond the rollback’s reach. That amount remains unrecovered. Earlier preliminary estimates had put the total affected value at $75 million, with roughly $6 million bridged out. The final post-mortem figures revised those numbers significantly higher, placing total borrowing activity at $120.4 million.
Communication and Transparency Gaps
Cronos acknowledged that communication during the shutdown was poor. The network also noted that reversed transactions can no longer be viewed through standard public blockchain explorers and must instead be accessed through archived records.
‘We recognize the disruption this incident caused across the Cronos ecosystem,’ the developers wrote. ‘With network operations restored, our focus remains on completing reconciliation with affected platforms and applying the lessons from this incident to strengthen ecosystem safeguards.’
A Pattern Across DeFi
The decision to halt and roll back a chain is rare but not unprecedented. In August, Maya Protocol suspended its network after an attacker exploited six software vulnerabilities and extracted approximately $1.65 million. Separately, an exploit on Ravencoin prompted efforts to reconstruct its blockchain, putting roughly three days of transactions at risk of reversal. Security researchers have also warned that AI tools could accelerate the pace at which attackers discover protocol vulnerabilities, though the Cronos post-mortem contains no evidence of AI involvement in the Tectonic attack.
