Cronos Rollback Reverses $111M, Leaves $9.2M Unrecovered
Cronos says $9.19 million remains unrecovered after validators rolled back the Tectonic exploit and reversed most of the borrowed assets still recorded on the network.
Key Takeaways
- Inflated TONIC collateral enabled $120.4M borrowing.
- The rollback reversed about $111.2 million.
- $9.19 million left Cronos unrecovered.
- 10,961 blocks were removed from history.
- Services are still reconciling affected transactions.
Cronos says the attacker borrowed $120.4 million
According to Cronos’ post-mortem, an attacker manipulated collateral on the Tectonic lending protocol and borrowed $120.4 million across nine markets before validators halted the network on August 30.
Cronos had initially halted block production after the Tectonic exploit, when the scale of the incident was still based on early on-chain estimates. The post-mortem now separates the value borrowed, the value reversed on Cronos and the amount that left the network before the halt.
The response window explains why some funds escaped
Cronos’ timeline shows how quickly the attack progressed. The attacker first deployed contracts and manipulated the price of TONIC. About 10 minutes later, the inflated collateral was used to borrow $120.4 million across nine markets.
The network team identified the malicious activity roughly 36 minutes after the attack began. Block production was halted later at block 90,907,150, but $9.19 million had already left Cronos by then. The amount remaining on the network could still be reversed; assets transferred beyond it could not.
Cronos resumed block production about 11 hours after the attack began, using the last pre-exploit block as the restored state.
— Cronos Network (@CronosNetwork) September 8, 2026
How inflated TONIC collateral enabled the borrowing
Tectonic lets users deposit collateral and borrow against its value. Cronos said the attacker drove up the price of TONIC, Tectonic’s thinly traded token, then used the inflated value as collateral.
A lending protocol calculates borrowing capacity from the reported value of a user’s collateral. If that price rises sharply, the position may appear able to support a much larger loan even when the underlying market cannot sustain the valuation.
By making TONIC appear more valuable to the protocol, the attacker increased the borrowing capacity of the position and withdrew liquid assets from nine lending markets. The $120.4 million figure refers to those borrowed assets, not to the market value of TONIC itself.
Mango Markets showed a similar collateral risk
The structure has a precedent in the 2022 Mango Markets manipulation. According to the US Commodity Futures Trading Commission, the price of the thinly traded MNGO token rose more than thirteenfold during a 30-minute period. The artificially inflated value of the attacker’s positions was then used as collateral to withdraw more than $110 million in digital assets.
The two incidents were not identical. Mango involved manipulated MNGO spot and perpetual markets, while the Cronos account describes inflated TONIC collateral used within Tectonic’s lending markets. The shared risk is that a sharp move in a low-liquidity token can create borrowing power far beyond the amount that could be realized by selling that token in the open market.
The rollback reversed assets still on Cronos
Validators rolled the chain back to block 90,896,188, the last block before the attack. The move reversed about $111.2 million that had not left Cronos and returned affected balances to their pre-exploit state.
A validator decision on Cronos cannot rewrite transactions that have already settled on another network. Cronos said the $9.19 million that left before the halt remains beyond the rollback’s reach, leaving recovery dependent on measures outside the chain restoration.
The response also reversed unrelated transactions
The rollback removed 10,961 blocks from Cronos history, covering 1 hour and 54 minutes. Every transaction recorded during that period was reversed, including transactions unrelated to Tectonic.
Cronos said validators made the decision after weighing the finality users expect from a blockchain against the risk of leaving the borrowed assets under the attacker’s control. Restarting without restoring the earlier chain state would have left the position intact.
The important questions concern the price sources used for TONIC, the collateral and borrowing limits applied to low-liquidity assets, and the conditions under which borrowing can be paused.
Lending protocols can limit this type of exposure through several controls:
- Conservative collateral factors that cap how much can be borrowed against volatile assets
- Asset-specific borrowing caps for low-liquidity tokens like TONIC
- Isolated markets that contain the damage to a single pool
- Circuit breakers that react to abnormal price movements
No single control removes oracle-manipulation risk, but these measures can restrict how much value can be borrowed before a manipulated price is detected.
Confirmation of which safeguards were active, which ones failed and what will change would provide a clearer assessment of whether the same route could be used again. The rollback restored the chain state, but it did not by itself correct the conditions that allowed the borrowing.
What remains unresolved
Block production has resumed, and Cronos says its explorer, public RPC endpoints, indexers and subgraphs are operating. The network is working with exchanges, bridges and other affected services to reconcile their records.
Cronos says users do not need to take action while that process continues. Cronos did not identify the attacker in its post-mortem or explain how the unrecovered $9.19 million may be recovered. The rollback resolved the assets still on Cronos; the remaining amount depends on tracing and recovering funds beyond the network’s control.
This article is for informational purposes only and does not constitute financial advice.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
