Cronos, a Layer 1 blockchain tied to Crypto.com, verified that approximately $9.19 million exited the network during the August 30 exploit and has not been retrieved.
In a post-mortem released on Monday, Cronos explained that a hacker twisted collateral mechanics on the lending protocol Tectonic to take out $120.4 million in loans before nodes paused the blockchain at block 90,907,150.
Following agreement among validators, the network was reverted to block 90,896,188, which was the final block prior to the security breach. This rollback returned impacted accounts to their condition before the incident, reversing roughly $111.2 million worth of affected assets.
Nevertheless, around $9.19 million, representing 7.6% of the compromised funds, had already been bridged out of the chain and could not be recovered. The crew stated, “The $9.19 million that left Cronos before the halt has not been recovered and is beyond the restoration’s reach.”
The developers pointed out that the rollback erased 1 hour and 54 minutes of blockchain history, amounting to 10,961 blocks, which implies that all transactions executed within that timeframe were undone regardless of whether they had any connection to the attack.
Cronos remarked, “It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk. The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.”
Price manipulation
The post-mortem additionally broke down the chronological sequence of the security incident. On August 30, the perpetrator launched smart contracts and artificially elevated the value of TONIC, which is Tectonic’s lightly traded governance token.
Roughly 10 minutes afterwards, the malicious actor leveraged this overvalued collateral to borrow $120.4 million distributed over nine distinct markets. The Cronos group spotted the illicit behavior about 36 minutes post-attack, triggering the subsequent network freeze and state rollback.
Cronos subsequently brought block creation back online approximately 11 hours after the breach commenced, with account balances restored to their pre-attack conditions, based on the update.
The personnel mentioned that they are actively collaborating with trading platforms, cross-chain bridges, and other impacted services to finish required reconciliations on their infrastructure, noting further that no steps need to be taken by users right now. The block explorer has returned online, while indexers, subgraphs, and public RPC nodes are functioning normally as well.
However, the post-mortem omitted any identification of the hacker and did not specify what measures will be taken regarding the missing $9.19 million. The Block has contacted Cronos to seek additional details.
CRO (CRO), which serves as the native cryptocurrency for the Cronos network, ticked up 0.62% over the preceding 24 hours, changing hands at $0.058.
Originally published at https://www.theblock.co/news/ecosystems/2026-09-08-cronos-post-mortem-413724.
