=== ARTICLE ===
Cronos, the blockchain network associated with Crypto.com, wiped out close to two hours’ worth of transaction records to undo roughly $111.2 million connected to a breach of the Tectonic lending protocol, per a post-incident report the network issued Monday.
To safeguard an estimated 92% of the affected assets that remained on the network, validators reversed finalized transactions — a move that runs counter to blockchains’ typical promise of permanence. The rollback wiped out 1 hour and 54 minutes of already-settled activity, sweeping up unrelated transactions along with those tied to the exploit.
The Hard Decision
“It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk,” Cronos’ devs wrote. “Restoring state meant discarding 1 hour 54 minutes of settled transactions. The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.”
Complicating matters further, the rollback also wiped out every valid transaction that had gone through during that same stretch of time. Positions on active applications were repriced once trading came back online.
How the Attack Worked
The breach occurred on August 30, when hackers went after Tectonic, a platform that allows borrowing against deposited crypto collateral. The report states the attacker inflated TONIC’s price on thinly traded decentralized exchanges, then used that inflated collateral to borrow roughly $120.4 million spread across nine separate markets.
Validators froze the network at 9:32 a.m. EST and subsequently reverted 10,961 blocks, wiping out 1 hour and 54 minutes’ worth of activity.
What Got Reversed
“Every transaction in that window was reversed, whether or not it touched the exploit, and open positions on live apps repriced when trading resumed,” Cronos wrote.
Even with the rollback, about $9.19 million had already exited Cronos before validators froze the network. According to the post-mortem, that sum remains missing and fell outside what the rollback could recover.
The Numbers So Far
Early figures pointed to $75 million in affected value and $6 million bridged elsewhere. Cronos’s own tally lists $120.4 million in total borrowing, of which roughly $111.2 million was clawed back through the rollback.
- Approximately $120.4 million borrowed across nine markets
- Approximately $111.2 million reversed by the rollback
- Approximately $9.19 million left the network and remains unrecovered
- 10,961 blocks rolled back
- 1 hour 54 minutes of transactions erased
Network Restart
After roughly nine hours offline, block production picked back up at 6:49 p.m. EST on August 30. Getting the network running again took several rounds of coordination among validators, who relied on patched software while preserving the same transaction history.
Cronos admitted its communication during the outage fell short. It noted that the transactions which were reversed can still be verified through archived records, even though they won’t show up on standard public blockchain explorers anymore.
“We recognize the disruption this incident caused across the Cronos ecosystem,” Cronos wrote. “With network operations restored, our focus remains on completing reconciliation with affected platforms and applying the lessons from this incident to strengthen ecosystem safeguards.”
Other Crypto Exploits
This isn’t the first time a blockchain project has had to choose between shutting things down or unwinding transactions in the wake of an attack. Maya Protocol, for instance, paused its network in August after a hacker exploited six separate software bugs to make off with roughly $1.65 million in crypto, the project said. Separately, a flaw discovered in Ravencoin forced developers to attempt rebuilding its chain, putting about three days of transaction history at risk of being reversed.
Security experts have warned that AI may help attackers find vulnerabilities faster. The Cronos post-mortem provides no evidence of AI involvement in the Tectonic attack.
The rollback worked for most funds, but not all. The unrecovered $9.19 million is a reminder that a blockchain can be undone — up to a point.
Source: decrypt.co
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.