Cronos erased two hours of its chain, and $9.19 million still left

Cronos published its post-mortem on Monday. An attacker manipulated collateral on the lending protocol Tectonic and borrowed $120.4 million across nine markets before validators halted the network at block 90,907,150. A rollback to block 90,896,188 reversed about $111.2 million. The Block reported that $9.19 million had already left the chain and remains unrecovered.

The post-mortem does not name the attacker and does not say what happens to the $9.19 million. The chain itself is more forthcoming.

“Reporting a price and validating that a price is safe to lend against are two different jobs, and Tectonic's design conflated them.”

— RedStone co-founder, crypto.news, September 2026

Quote source: RedStone co-founder, via crypto.news

The chain kept the scar

We queried a Cronos node for the block timestamps around the restart. Three numbers come out of it.

• Block 90,896,189 carries a timestamp of 12:38:55 UTC on 30 August.
• Block 90,896,190, the one right after it, carries 23:49:01 UTC the same day.
• The gap between two consecutive blocks is 11 hours and 10 minutes, and it is permanent.

Cronos produces a block every 0.4 to 0.6 seconds, so the 10,962 block numbers between the rollback point and the halt height amount to roughly two hours of history. Those numbers now exist twice: once on the chain that was deleted, once on the chain that replaced it. Anyone who traded, borrowed or bridged on Cronos during those two hours had their activity reversed along with the attacker's.

How the attack worked

The attacker spent about $600,000 to push TONIC, Tectonic's thinly traded governance token, up roughly a hundredfold in twenty minutes. They then supplied 364.6 trillion of the inflated tokens as collateral and borrowed across nine markets. Tectonic's documentation from May 2025 lists a 20% collateral factor for TONIC, though that table does not establish the setting at the time.

Security researchers have a name for this shape of attack after Mango Markets, and a similar collateral-price attack drained Moonwell of about $8.7 million shortly before. RedStone's co-founder told crypto.news the oracle reported TONIC's price correctly, and that a borrow cap tied to executable liquidity would have prevented the whole thing.

The numbers grew after the fact

The official figures are larger than the ones that circulated during the incident. Onchain researcher Weilin Li estimated $75 million affected, with about $6 million reaching Ethereum before the halt and roughly $69 million frozen at Cronos addresses. The post-mortem puts the borrowed sum at $120.4 million.

Tectonic's total value locked fell from $121.7 million to around $3 million within 48 hours, a decline of 97.5%. The rollback restored balances. It did not restore anyone's willingness to leave money there.

What a Cronos rollback costs

Cronos called the halt a validator-consensus emergency action, and it worked. Depositors who would have lost everything got their balances back, and Crypto.com said its centralized app and exchange were never affected.

The cost is the part the post-mortem skips. A chain that can be rewound by agreement among its validators offers a different product from the one the industry has been selling to regulators and institutions since Ethereum's DAO fork in 2016. When 4,000 BTC left Liquid last week, the negotiation happened in public between the attacker and the operators, and the ledger stayed as it was.

Watch what Cronos does with the $9.19 million. Reversing $111.2 million by consensus and then writing off the rest sets the price of the precedent: history is negotiable up to the point where the money has crossed a bridge. Cross-border enforcement is the slower answer, and governments only started coordinating on it last week.

None of this should be read as personalized investment advice.