Cronos, the Layer 1 network associated with Crypto.com, has released its official accounting of the August 30 attack on Tectonic. The review confirms that more than $9 million extracted during the incident remains outside the chain’s reach.
Validators later rolled the ledger back and reversed most of the damage, but assets that had already left Cronos could not be restored.
The attacker inflated the price of TONIC, Tectonic’s thinly traded governance token, then posted that inflated token as collateral.
Using the distorted valuation, the attacker borrowed about $120.4 million across nine of Tectonic’s lending markets.
The protocol’s price feed tracked the manipulated market, allowing the borrower to pull stablecoins, bitcoin, ether and other liquid assets far beyond TONIC’s real tradable depth.
Operators identified the irregular activity about 36 minutes after it started.
Validators then halted block production at height 90,907,150. After reaching consensus, they restored the chain to block 90,896,188—the last height recorded before the first malicious transactions.
That decision discarded 10,961 blocks, or one hour and 54 minutes of history.
Every transaction packed into that window, related to the exploit or not, was erased.
Balances that had remained on Cronos returned to their earlier state, reversing roughly $111.2 million of the borrowed value.
The remaining $9.19 million—about 7.6 percent of the $120.4 million total—had already been moved off the network through bridges and other outbound routes before the halt.
Those funds sit on other chains and therefore fall outside the rollback.
Cronos stated that the departed sum has not been recovered and is beyond the restoration’s reach.
The episode illustrates a hard limit of chain-level emergency measures.
A coordinated rollback can rewrite history inside one network, but it cannot reach assets once they have crossed a bridge.
Earlier on-chain estimates had placed the escaped amount closer to $6 million–$8.3 million; the official figure is now higher.
The same intervention also cancelled legitimate activity that happened to fall inside the discarded window, an unavoidable cost of resetting the entire chain rather than targeting individual addresses.
Tectonic, previously the largest lending protocol on Cronos, saw its total value locked collapse around the attack.
The network itself resumed block production later on August 30 after the pre-exploit state was restored.
Cronos has said it is coordinating with exchanges and investigators to trace the outbound transfers, but recovery of the escaped $9.19 million remains uncertain.
The case adds to a wider pattern of price-manipulation attacks against DeFi lenders that accept low-liquidity tokens as collateral.
Here, a thin TONIC market, a relatively generous collateral factor, and a price feed that followed the manipulated pool created the opening. The rapid halt limited further leakage, yet it could not close the gap left by funds that had already departed.
