Cronos has confirmed that $9.19 million remains unrecovered after an attacker borrowed $120.4 million from Tectonic, while a validator-backed rollback reversed roughly $111.2 million in affected value.
According to a post-mortem published by Cronos on Monday, the attacker manipulated the price of TONIC, the governance token of lending protocol Tectonic, and used the inflated asset as collateral to borrow funds across nine markets on Aug. 30.
The attack led Cronos validators to halt the Layer 1 blockchain at block 90,907,150 before agreeing to restore the network to block 90,896,188, the final block produced before the exploit began.
The rollback returned affected balances to their pre-attack state and reversed approximately $111.2 million of the $120.4 million involved in the incident. However, funds that had already moved away from Cronos were outside the reach of the restoration.
“The $9.19 million that left Cronos before the halt has not been recovered and is beyond the restoration’s reach,” the team said.
The rollback discarded 10,961 blocks, representing 1 hour and 54 minutes of Cronos transaction history, according to the post-mortem. Transactions completed during that window were reversed regardless of whether they had any connection to the Tectonic attack.
Cronos said validators had to weigh transaction finality against the amount of money still exposed when deciding how to restart the network.
“It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk,” Cronos said. “The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.”
The final accounting substantially raises the value involved compared with early estimates published immediately after the incident. On Aug. 31, crypto.news reported the Cronos halt after onchain researcher Weilin Li initially estimated that approximately $75 million had been affected.
Li’s early analysis found that most of the identified funds remained on Cronos when validators stopped block production, while roughly $6 million was believed to have reached Ethereum. At the time, neither Tectonic nor Cronos had released a final accounting of the assets involved.
Blockchain data provider Bitquery subsequently calculated that $120.4 million had been removed from Tectonic’s lending markets, a figure that is consistent with the amount detailed in Cronos’ post-mortem.
Cronos said the attack began after contracts were deployed to manipulate the market price of TONIC, a thinly traded token that Tectonic accepted as collateral.
Once the token’s price had been driven higher, the attacker supplied the inflated collateral to the lending protocol. Roughly 10 minutes later, $120.4 million had been borrowed across nine Tectonic markets.
Early onchain analysis had found that TONIC’s reported price increased approximately 100-fold within around 20 minutes. The token carried a 20% collateral factor on Tectonic, allowing borrowers to take loans against part of the value assigned to their deposited TONIC.
RedStone co-founder Marcin Kazmierczak later told crypto.news that the incident was not an oracle failure. He said the oracle accurately reported the TONIC price in the market it monitored, while Tectonic accepted that price without adequately accounting for whether enough liquidity existed to sell the collateral at the reported valuation.
Kazmierczak identified borrow caps tied to executable liquidity as one safeguard that could have restricted the amount available to borrow even if TONIC’s reported market price increased sharply. Dynamic collateral factors, minimum market-depth requirements and price-impact limits could have provided other controls, he said.
Tectonic had roughly $121.7 million in total value locked and approximately $82.7 million in active loans before the exploit, according to figures cited during the initial investigation.
The post-mortem provided a more detailed timeline of the network’s response.
After the attacker began manipulating TONIC and borrowing against the inflated collateral, Cronos identified the malicious activity roughly 36 minutes later. Validators subsequently halted the blockchain, preventing further transactions while the incident was investigated.
The network was eventually restored to its pre-exploit state before block production resumed around 11 hours after the attack began.
When Cronos restarted block production on Aug. 30, the chain resumed from block 90,896,189 after validators coordinated the emergency restoration. Node operators were instructed to restart using Cronos v1.7.8 and updated mainnet snapshots.
Crypto.com CEO Kris Marszalek said during the incident that the company’s centralized app and exchange continued operating and were not compromised. Crypto.com and Cronos are closely associated, while Tectonic operates as a decentralized lending protocol on the blockchain.
The rollback meant infrastructure providers connected to Cronos had to reconcile their systems with the restored chain state. RPC providers, explorers, indexers, subgraphs and bridges needed to synchronize with the version of the blockchain that replaced the discarded blocks.
A subsequent crypto.news analysis examined how validators rolled back the chain and erased more than 10,000 blocks to restore its state. The action removed transactions belonging to regular users during the same period alongside those connected to the attacker.
Cronos’ post-mortem now puts the amount that escaped the restoration at approximately $9.19 million, equal to 7.6% of the $120.4 million affected.
Funds that remained within the network could effectively be returned to their earlier state through the rollback. Assets already transferred away from Cronos could not be reversed through changes to the chain’s own transaction history.
The Tectonic incident accounted for more than half of the estimated cryptocurrency losses recorded during August. Blockchain security firm PeckShield counted 50 major crypto hacks during August, with estimated losses totaling $136.3 million. Its earlier calculation placed the Tectonic incident at approximately $74 million because the final accounting had not yet been released.
Cronos said reconciliation work with exchanges, bridges and other affected platforms remains underway following the restoration. Users do not need to take any action at this stage, while the block explorer, public RPC endpoints, indexers and subgraphs have returned to operation.
The post-mortem did not identify the attacker or detail how the network and Tectonic plan to address the $9.19 million that remains unrecovered.
CRO, the native token of the Cronos ecosystem, was trading around $0.058, up 0.62% over the past 24 hours.
