Cronos validators erase transaction history to contain massive $75 million lending protocol exploit

Cronos has restarted and restored block production after validators restored the chain to its state before the Tectonic exploit, replacing an open-ended network halt with a monitored restart. In an Aug. 31 update, Cronos said the restarted chain was producing blocks from block 90,896,189, with a timestamp of 23:49:01 UTC on Aug. 30.

The network said it was fully back online, but added that some protocols, RPC providers, explorers and bridges could take longer to recover. Cronos also said it was monitoring the chain for stability and would publish a full postmortem. Those details superseded a 05:24 UTC update on Aug. 31 that said the network remained halted while the investigation continued.

Cronos had announced the halt on Aug. 30 after identifying an exploit at Tectonic, a decentralized lending protocol on the chain. The response made the wider blockchain, rather than only Tectonic, unavailable while validators and security teams assessed the incident.

Tectonic separately acknowledged an incident and told users not to interact with the protocol until it confirmed that doing so was safe.

How the Tectonic exploit unfolded

Onchain researcher Weilin Li attributed the exploit to manipulation of TONIC, Tectonic's thinly traded governance token. According to Li's analysis, the attacker inflated TONIC's price and used the token as collateral to borrow other assets from Tectonic.

The protocol's documentation lists a 20% collateral factor for TONIC in a parameter table dated May 2025. However, that historical table does not establish the configuration at the time of the incident.

Li initially estimated that about $66 million was affected, then raised the figure to roughly $75 million after identifying another attacker-controlled address. He estimated that only about $6 million was bridged to Ethereum before Cronos halted, leaving most of the affected assets on the network. The figures and attack mechanism remain Li's assessment rather than an official accounting.

What the Cronos restart changes

The restart relied on restoring the chain state to before the Tectonic exploit. Cronos said node operators could restart on version 1.7.8 using updated mainnet snapshots. The network did not say in the cited update how the rollback would affect all transactions submitted during the discarded period.

The difference between Li's total estimate and the reported bridge flow helps explain why the validator halt may have limited onward movement. However, Cronos and Tectonic have not published a confirmed loss, an official root-cause analysis or a complete account of how attacker-controlled assets will be handled.

Crypto.com CEO Kris Marszalek said the company's app and exchange were unaffected, were operating normally and had sent security staff to assist Cronos. That assurance applies to Crypto.com's services, not to Tectonic depositors.

The immediate uncertainty has shifted from when Cronos will restart to how quickly connected services recover and what the promised postmortem establishes. Those details will determine the final accounting and whether Tectonic users can resume normal activity.