Cronos Rollback Erases $111M of $120M Tectonic Exploit Transfers

[Update, Sept. 7, 2026, 8:30 UTC: Added details on Cronos rollback and restart, Bitquery’s revised $120.4 million estimate and Tectonic’s phased reopening plans.]

Cronos validators rolled back the blockchain on Aug. 30, after an attacker moved an estimated $120.4 million from decentralized lender Tectonic, erasing most exploit transactions while $8.3 million remained on Ethereum.

Blockchain data provider Bitquery said one transaction emptied nine Tectonic lending markets in 11 transfers on Aug. 30, taking stablecoins, Bitcoin, Ether and other assets. Its finding supersedes blockchain researcher Weilin Li’s earlier estimate of roughly $75 million. 

Cronos halted its network during the exploit. In a later update, it said validators restored the chain to a point before the attack and resumed production on Aug. 30 from block 90,896,189. Cronos called the rollback a “validator-consensus emergency action.” 

The rollback discarded 10,961 blocks, representing nearly two hours of chain history, including transactions unrelated to Tectonic, according to Bitquery. It erased about $111 million in attacker-controlled assets that remained on Cronos but could not affect funds already transferred to Ethereum.

At least $8.3 million escaped before Cronos halted

Bitquery traced the $8.3 million to four Ethereum wallets. About $6.3 million arrived as USDC and was converted into Ether, while other assets were sold for CRO before being bridged. The last of 28 CRO bridge transfers cleared 83 seconds before Cronos stopped producing blocks. Bitquery found no exchange deposits or mixer activity at the time of its analysis. 

The attacker deposited $5 million, repeatedly borrowed and redeposited TONIC in a 98-cycle loop, then used borrowed funds to buy the thinly traded token, Bitquery said. TONIC’s market price rose nearly 300-fold as Tectonic’s price feed followed, allowing the attacker to borrow against inflated collateral. 

Related: Galaxy puts Coldcard hack losses at 1,789 BTC, with 87% unmoved

Bitquery said that after the rollback, Tectonic’s USDC market was restored from three cents to $54.2 million. Because the attacker’s initial capital arrived before the rollback point, the action also restored their roughly $5 million deposit. 

Tectonic said it was checking its systems and dependencies and planned a phased reopening, starting with withdrawals and loan repayments while deposits and borrowing remained paused. 

Crypto.com CEO Kris Marszalek said its security team was assisting Cronos’s investigation. He said the Crypto.com app and exchange were unaffected and user funds were safe.

Cointelegraph contacted Crypto.com and Cronos for additional details, but both directed to their official social accounts for updates.

Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest