Cronos Confirms $9.19M Left Before Tectonic Rollback

Cronos reported that $9.19 million left its blockchain before validators halted the network during the Tectonic exploit and applied a rollback. The project’s post‑mortem puts total affected borrowing at $120.4 million and shows that restoring the chain reversed roughly $111.2 million, leaving 7.6% of the impacted funds outside the network.

The post‑mortem states manipulated collateral values on the Tectonic lending protocol produced about $120.4 million in borrowing activity on Aug. 30. On‑chain traces in the report show an initial deposit of about $5 million was followed by repeated borrowing and redepositing of the protocol’s TONIC token. That loop ran 98 cycles while the attacker purchased TONIC on thinly traded markets, driving the token’s on‑chain price nearly 300 times higher. Tectonic’s price feed followed the inflated price, which allowed large withdrawals. One transaction sequence emptied nine different Tectonic lending markets through 11 transfers involving stablecoins, Bitcoin, Ether and other assets.

Tectonic detected the suspicious activity at 12:49 UTC on Aug. 30. Validators halted block production at 14:32:47 UTC to stop further transactions and enable a corrective ledger rollback. After Cronos applied the rollback and restored balances for affected accounts, block production resumed at 23:49:01 UTC.

Cronos’ accounting indicates $9.19 million of the affected funds were transferred off‑chain before the halt and therefore could not be reversed by the rollback. Earlier on‑chain tracing by a blockchain data provider traced roughly $8.3 million to Ethereum; the higher figure in Cronos’s report reflects additional transfers identified in the post‑mortem and the challenge of tracking cross‑chain movements during a fast‑unfolding exploit.

Tectonic operates as a decentralized lending protocol on the Cronos Layer‑1 blockchain. The post‑mortem provides a detailed tally of amounts that were restored by the rollback and amounts that left the network prior to intervention. The report documents the attack method, the timeline of detection and halting, and the final accounting of funds affected and recovered.