Cronos says $9.2 million remains unrecovered after Tectonic exploit, chain rollback

Cronos, a Layer 1 blockchain associated with Crypto.com, confirmed that roughly $9.19 million had left the chain during the Aug. 30 exploit and remains unrecovered.

In a post-mortem published Monday, Cronos said an attacker manipulated collateral on lending protocol Tectonic to borrow $120.4 million before validators halted the network at block 90,907,150.

Following validator consensus, the chain was rolled back to block 90,896,188 — the last block before the attack. The rollback restored affected balances to their pre-exploit state, reversing roughly $111.2 million in impacted value.

However, about $9.19 million, or 7.6% of the affected funds, had already been transferred off the network and could not be restored. "The $9.19 million that left Cronos before the halt has not been recovered and is beyond the restoration's reach," the team said.

The team noted that the rollback discarded 1 hour 54 minutes of chain history, or 10,961 blocks, meaning that transactions during the period were reversed regardless of whether they were related to the exploit.

"It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk," Cronos said. "The alternative, restarting without restoring state, would have left the borrowed assets in the attacker's control."

Price manipulation

The post-mortem also detailed the timeline of the attack. On Aug. 30, the attacker deployed contracts and drove up the price of TONIC, Tectonic's thinly traded governance token.

About 10 minutes later, the attacker used the inflated collateral to borrow $120.4 million across nine markets. The Cronos team identified the malicious activity about 36 minutes after the attack, leading to subsequent suspension and rollback.

Cronos then resumed block production about 11 hours after the attack began, with balances back to their pre-exploit state, according to the post.

The team said that it is still working with exchanges, bridges, and other affected platforms to complete the necessary reconciliation on their systems, adding that no user action is required at this time. The block explorer is back online, and indexers, subgraphs, and public RPC endpoints are operational as well. 

The post-mortem, however, did not name the attacker or say what will happen to the unrecovered $9.19 million. The Block has reached out to Cronos for further information.

CRO (CRO), the native token of the Cronos ecosystem, edged up 0.62% in the past 24 hours, trading at $0.058.