Cronos Rollback Reverses $111M, Leaves $9.2M Unrecovered

Key Takeaways Inflated TONIC collateral enabled $120.4M borrowing. The rollback reversed about $111.2 million. $9.19 million left Cronos unrecovered. 10,961 blocks were removed from history. Services are still reconciling affected transactions. Cronos says the attacker borrowed $120.4 million According to Cronos’ post-mortem, an attacker manipulated collateral on the Tectonic lending protocol and borrowed $120.4 million across nine markets before validators halted the network on August 30. Cronos had initially halted block production after the Tectonic exploit, when the scale of the incident was still based on early on-chain estimates. The post-mortem now separates the value borrowed, the value reversed on Cronos and the amount that left the network before the halt. What happened to the borrowed assets FigureWhat it represents$120.4MTotal borrowed from nine Tectonic markets before the halt.$111.2MValue that had not left Cronos and was reversed by the rollback.$9.19MValue that left Cronos before the halt and remains unrecovered.10,961 blocksCronos history spanning 1 hour and 54 minutes that was discarded during the rollback. The response window explains why some funds escaped Cronos’ timeline shows how quickly the attack progressed. The attacker first deployed contracts and manipulated the price of TONIC. About 10 minutes later, the inflated collateral was used to borrow $120.4 million across nine markets. The network team identified the malicious activity roughly 36 minutes after the attack began. Block production was halted later at block 90,907,150, but $9.19 million had already left Cronos by then. The amount remaining on the network could still be reversed; assets transferred beyond it could not. Cronos resumed block production about 11 hours after the attack began, using the last pre-exploit block as the restored state. https://t.co/h7gGiB0cw2 — Cronos Network (@CronosNetwork) September 8, 2026 How inflated TONIC collateral enabled the borrowing Tectonic lets users deposit collateral and borrow against its value. Cronos said the attacker drove up the price of TONIC, Tectonic’s thinly traded token, then used the inflated value as collateral. A lending protocol calculates borrowing capacity from the reported value of a user’s collateral. If that price rises sharply, the position may appear able to support a much larger loan even when the underlying market cannot sustain the valuation. By making TONIC appear more valuable to the protocol, the attacker increased the borrowing capacity of the position and withdrew liquid assets from nine lending markets. The $120.4 million figure refers to those borrowed assets, not to the market value of TONIC itself. Mango Markets showed a similar collateral risk The structure has a precedent in the 2022 Mango Markets manipulation. According to the US Commodity Futures Trading Commission, the price of the thinly traded MNGO token rose more than thirteenfold during a 30-minute period.