.jpg)
Cronos has resumed block production after validators halted the network during an exploit targeting Tectonic and restored the chain state to a point before the attack.
The network said the blockchain was fully back online after the validator set coordinated an emergency halt designed to protect users while the Tectonic incident was being contained. The restart followed a rollback of the network state, effectively returning Cronos to its condition before the exploit.
Block Production Resumes After Rollback
Block production resumed at 23:49:01 UTC on Aug. 30 from block 90,896,189. Node operators have been instructed to restart using Cronos v1.7.8 and the latest mainnet snapshots dated Aug. 31 at 09:52 UTC. The network remains under observation while operators check its stability. Cronos warned that some protocols, RPC providers, blockchain explorers and bridges may take longer to restore their services as individual operators complete their own checks.
"We will be releasing a full postmortem soon," Cronos said. The shutdown came after an exploit hit Tectonic, a decentralized lending protocol built on Cronos. Tectonic told users on Aug. 30 that it was investigating an incident and asked them not to interact with the protocol until its team confirmed that it was safe. Cronos validators subsequently stopped block production, preventing transactions from being processed across the network.
Tectonic Exploit Estimated at $75 Million
Onchain researcher Weilin Li estimated that the exploit affected roughly $75 million after initially identifying approximately $66 million connected to the attack and later finding another attacker-controlled address holding close to $8 million. Tectonic and Cronos have not confirmed the estimated loss, making the figure provisional until the promised postmortem provides a full accounting.
Li linked the incident to manipulation of TONIC, Tectonic's governance token. According to his analysis, the attacker drove TONIC's price roughly 100 times higher within around 20 minutes and then supplied the inflated tokens as collateral to borrow other assets from Tectonic. Tectonic's lending parameters allowed TONIC to be used with a 20% collateral factor. Li identified approximately 364.6 trillion TONIC in the attack position, which would have required the tokens to carry an inflated value of roughly $375 million to support around $75 million in borrowing.
Only a portion of the assets had left Cronos before validators stopped the network. Li estimated that around $6 million had been bridged to Ethereum, leaving most of the assets linked to the exploit on Cronos when block production stopped. Neither Cronos nor Tectonic has independently confirmed that estimate. Crypto.com CEO Kris Marszalek said the company's app and exchange were not compromised by the Tectonic incident.
Chain State Restored to Before the Exploit
Instead of restarting Cronos from the state at which validators stopped producing blocks, the network restored its state to a point before the Tectonic attack. Restoring the earlier state meant transactions recorded as part of the exploit after the selected restoration point would no longer form part of the restarted chain's history. The network has not yet published the technical details behind the restoration, including the exact process validators followed to agree on the earlier state.
Before the exploit, Tectonic held approximately $121.7 million in total value locked and around $82.7 million in active loans, according to data cited by The Block. The Tectonic response follows several emergency blockchain shutdowns linked to security incidents in recent weeks. On Aug. 25, Cosmos EVM chains were advised to request validator halts while Cosmos Labs investigated a security incident. MANTRA had stopped its own network several days earlier while investigating a separate incident. Read about another recent DeFi exploit and network emergency halts.
.jpg)
.jpg)
