Cronos Confirms $9.19M Still Missing After $120M DeFi Exploit

Cronos has released a post-mortem confirming that $9.19 million remains unrecovered following an exploit of the Tectonic lending protocol that saw an attacker borrow $120.4 million by manipulating the price of Tectonic's governance token, TONIC, and using the inflated asset as fraudulent collateral. The attack, which occurred on 30 August, prompted Cronos validators to halt the blockchain before agreeing to roll the network back to the last block produced before the exploit began.

The rollback reversed approximately $111.2 million of the affected funds by restoring balances to their pre-attack state, but it discarded almost 11,000 blocks, wiping out nearly two hours of transaction history regardless of whether those transactions were connected to the attack. Funds that had already left the Cronos network before the halt, worth $9.19 million, were beyond the reach of the restoration.

Cronos said the decision to roll back the chain involved a difficult trade-off between preserving transaction finality that users expect and preventing the attacker from retaining control of the borrowed assets. The final figures are significantly higher than early estimates, which had put the affected amount at around $75 million.