TL;DR
- Cronos validators halted the network and rolled back the chain to its state prior to the Tectonic protocol exploit.
- An onchain researcher estimated that approximately $75 million was affected; only $6 million was bridged to Ethereum before the halt.
- The network resumed block production, but some connected services are still recovering and the official postmortem remains pending.
Validators of Cronos took an unprecedented step by fully halting the network and rolling back the chain state to a point prior to the exploit that affected Tectonic, a decentralized lending protocol built on that blockchain.
The move took the entire network offline while security teams assessed the incident. In an update on August 31, the network confirmed that the chain had resumed block production from block 90,896,189, with a timestamp corresponding to 23:49:01 UTC on August 30.
The Cronos Network is producing blocks again and is fully back online.
The Cronos Network halted earlier today. This was a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol. The chain state was restored to before the Tectonic exploit…
— Cronos Network (@CronosNetwork) August 31, 2026
What Happened with Cronos and Tectonic
According to the analysis of onchain researcher Weilin Li, the attack relied on price manipulation of TONIC, Tectonic’s governance token, which has thin market liquidity. The attacker artificially inflated the value of TONIC and used it as collateral to borrow other assets from the protocol.
Tectonic’s documentation records a collateral factor of 20% for TONIC in a parameter table dated May 2025, although that record does not confirm the exact configuration at the time of the incident. Li raised his initial estimate of $66 million to approximately $75 million after identifying an additional address controlled by the attacker, and calculated that only around $6 million was bridged to Ethereum before the halt, suggesting that the majority of the compromised assets remained within the network.
Partial Recovery and Unanswered Questions
The restoration of Cronos required node operators to restart using version 1.7.8 with updated mainnet snapshots. The network confirmed it was fully operational, though it warned that some RPC providers, explorers, and bridges might need additional time to recover.
Kris Marszalek, CEO of Crypto.com, clarified that the company’s app and exchange were not affected and that security personnel were deployed to assist the network. Tectonic, for its part, instructed users to not interact with the protocol until confirming it was safe to do so. The questions now revolve not around when Cronos would resume operations, but around how quickly connected services will recover and what the promised postmortem will reveal about the fate of the compromised assets.
