Cronos Network has resumed block production after validators halted the blockchain to contain an exploit targeting Tectonic, its largest decentralized lending protocol. The incident reportedly placed about $75 million in assets at risk and triggered an emergency network shutdown.
Cronos confirmed that validators restored the chain to a state from before the exploit. Block production resumed at 23:49:01 UTC on Aug. 30, starting from block 90,896,189. The network is now undergoing close monitoring for stability and compatibility issues.
Emergency Halt Contained Most Funds
The attack reportedly manipulated the price of Tectonic’s TONIC governance token before using the inflated asset as collateral to borrow other cryptocurrencies from lending pools.
On-chain researchers estimated that the attacker obtained roughly $75 million in assets. However, only about $6 million reportedly reached Ethereum before Cronos validators stopped block production. Most of the remaining assets became stranded on the Cronos network during the halt.
The exploit highlighted risks tied to using thinly traded tokens as collateral. TONIC had relatively limited liquidity, allowing its market price to move sharply during the attack.
Rollback Raises Key Questions
The decision to restore the blockchain to a pre-exploit state marks a significant intervention in the network’s transaction history. Cronos described the halt as a validator-consensus emergency action designed to protect users while investigators responded to the attack.
Crypto.com’s exchange and app remained operational during the incident, with the company saying customer funds on those platforms were unaffected. Tectonic also urged users not to interact with its protocol while its investigation continued.
The final financial impact remains uncertain. Estimates have varied, and Tectonic has not yet published a definitive loss figure or detailed technical explanation.
Cronos said a postmortem will provide further information about the exploit and the network restoration. Until that report appears, questions about the attack’s root cause, affected users and the treatment of compromised assets remain unresolved.
