Cronos has confirmed that $9.19 million remains unrecovered following the August 30 exploit of its Tectonic lending protocol, even after a validator-approved rollback restored roughly $111.2 million in affected funds.
The attacker deployed smart contracts that artificially inflated the price of TONIC, Tectonic’s thinly traded governance token, and used the manipulated collateral value about ten minutes later to borrow $120.4 million across nine markets. Cronos detected the malicious activity approximately 36 minutes after it began and coordinated an emergency response with validators. Validators halted the network at block 90,907,150 and later approved a rollback to block 90,896,188, the final block before the exploit.
The rollback removed 10,961 blocks, representing 1 hour and 54 minutes of chain history, and restored balances that had not moved off-chain. However, about $9.19 million — roughly 7.6% of the unauthorized borrowing — had already been transferred through bridges, exchanges, or other networks and could not be reversed. The intervention also erased legitimate transactions unrelated to Tectonic, forcing Cronos to balance transaction finality against potential fund losses. Block production resumed about 11 hours after the incident began, and the block explorer, indexers, subgraphs, and public RPC endpoints have since returned to service.
Cronos said it is working with exchanges, bridges, and affected platforms to reconcile reversed transactions. The post-mortem did not identify the attacker or specify how the outstanding $9.19 million might be pursued. The incident also drew comparisons to the 2022 Mango Markets exploit, raising new scrutiny on price feeds, collateral limits, borrowing caps, and circuit breakers for low-liquidity tokens. CRO traded near $0.058 after a modest 0.62% 24-hour gain.
