Cronos

Mango

Value

Tectonic

when

<div class="light-yellow-block">
 <h2 style="text-align: left;" id="strong-key-takeaways-strong"><strong>Key Takeaways</strong></h2>
 <ul>
  <li><strong>Inflated TONIC collateral enabled $120.4M borrowing.</strong></li>
  <li><strong>The rollback reversed about $111.2 million.</strong></li>
  <li><strong>$9.19 million left Cronos unrecovered.</strong></li>
  <li><strong>10,961 blocks were removed from history.</strong></li>
  <li><strong>Services are still reconciling affected transactions.</strong></li>
 </ul>
</div>
<h2 id="cronos-says-the-attacker-borrowed-120-4-million">Cronos says the attacker borrowed $120.4 million</h2>
<p>According to <a href="https://x.com/CronosNetwork/status/2097131718948094299" rel="noopener noreferrer nofollow">Cronos’ post-mortem</a>, an attacker manipulated collateral on the Tectonic lending protocol and borrowed $120.4 million across nine markets before validators halted the network on August 30.</p>
<p>Cronos had initially halted block production after the <a href="https://coindoo.com/cronos-halts-chain-after-75m-tectonic-exploit/" rel="noopener noreferrer nofollow">Tectonic exploit</a>, when the scale of the incident was still based on early on-chain estimates. The post-mortem now separates the value borrowed, the value reversed on Cronos and the amount that left the network before the halt.</p>
<div style="margin: 28px 0; overflow: hidden; border: 1px solid #dbe3f1; border-radius: 16px; background: #ffffff; box-shadow: 0 4px 14px rgba(15,23,42,0.08);">
 <div style="padding: 18px 22px; background: linear-gradient(135deg,#0f172a,#1e3a8a); color: #ffffff;">
  <p style="margin: 0; font-size: 20px; line-height: 1.3;"><strong>What happened to the borrowed assets</strong></p>
 </div>
 <div style="padding: 18px;">
  <table style="width: 100%; border-collapse: collapse; font-size: 16px;">
   <thead>
    <tr style="background: #f8fafc; color: #0f172a;">
     <th style="padding: 13px; text-align: left; border-bottom: 1px solid #dbe3f1;">Figure</th>
     <th style="padding: 13px; text-align: left; border-bottom: 1px solid #dbe3f1;">What it represents</th>
    </tr>
   </thead>
   <tbody>
    <tr>
     <td style="padding: 13px; border-bottom: 1px solid #e2e8f0;"><strong>$120.4M</strong></td>
     <td style="padding: 13px; border-bottom: 1px solid #e2e8f0;">Total borrowed from nine Tectonic markets before the halt.</td>
    </tr>
    <tr style="background: #f8fafc;">
     <td style="padding: 13px; border-bottom: 1px solid #e2e8f0;"><strong>$111.2M</strong></td>
     <td style="padding: 13px; border-bottom: 1px solid #e2e8f0;">Value that had not left Cronos and was reversed by the rollback.</td>
    </tr>
    <tr>
     <td style="padding: 13px; border-bottom: 1px solid #e2e8f0;"><strong>$9.19M</strong></td>
     <td style="padding: 13px; border-bottom: 1px solid #e2e8f0;">Value that left Cronos before the halt and remains unrecovered.</td>
    </tr>
    <tr style="background: #f8fafc;">
     <td style="padding: 13px;"><strong>10,961 blocks</strong></td>
     <td style="padding: 13px;">Cronos history spanning 1 hour and 54 minutes that was discarded during the rollback.</td>
    </tr>
   </tbody>
  </table>
 </div>
</div>
<h2 id="the-response-window-explains-why-some-funds-escaped">The response window explains why some funds escaped</h2>
<p>Cronos’ timeline shows how quickly the attack progressed. The attacker first deployed contracts and manipulated the price of TONIC. About 10 minutes later, the inflated collateral was used to borrow $120.4 million across nine markets.</p>
<p>The network team identified the malicious activity roughly 36 minutes after the attack began. Block production was halted later at block 90,907,150, but $9.19 million had already left Cronos by then. The amount remaining on the network could still be reversed; assets transferred beyond it could not.</p>
<p>Cronos resumed block production about 11 hours after the attack began, using the last pre-exploit block as the restored state.</p>
<blockquote class="twitter-tweet">
 <p><a href="https://t.co/h7gGiB0cw2" rel="noopener noreferrer nofollow">https://t.co/h7gGiB0cw2</a></p>
 <p>— Cronos Network (@CronosNetwork) <a href="https://x.com/CronosNetwork/status/2097131718948094299?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 8, 2026</a></p>
</blockquote>
<h2 id="how-inflated-tonic-collateral-enabled-the-borrowing">How inflated TONIC collateral enabled the borrowing</h2>
<p>Tectonic lets users deposit collateral and borrow against its value. Cronos said the attacker drove up the price of TONIC, Tectonic’s thinly traded token, then used the inflated value as collateral.</p>
<p>A lending protocol calculates borrowing capacity from the reported value of a user’s collateral. If that price rises sharply, the position may appear able to support a much larger loan even when the underlying market cannot sustain the valuation.</p>
<p>By making TONIC appear more valuable to the protocol, the attacker increased the borrowing capacity of the position and withdrew liquid assets from nine lending markets. The $120.4 million figure refers to those borrowed assets, not to the market value of TONIC itself.</p>
<h2 id="mango-markets-showed-a-similar-collateral-risk">Mango Markets showed a similar collateral risk</h2>
<p>The structure has a precedent in the 2022 <a href="https://www.cftc.gov/PressRoom/PressReleases/8647-23" rel="noopener noreferrer nofollow">Mango Markets manipulation</a>. According to the US Commodity Futures Trading Commission, the price of the thinly traded MNGO token rose more than thirteenfold during a 30-minute period. The artificially inflated value of the attacker’s positions was then used as collateral to withdraw more than $110 million in digital assets.</p>
<p>The two incidents were not identical. Mango involved manipulated MNGO spot and perpetual markets, while the Cronos account describes inflated TONIC collateral used within Tectonic’s lending markets. The shared risk is that a sharp move in a low-<a rel="noopener noreferrer nofollow">liquidity</a> token can create borrowing power far beyond the amount that could be realized by selling that token in the open market.</p>
<h2 id="the-rollback-reversed-assets-still-on-cronos">The rollback reversed assets still on Cronos</h2>
<p>Validators rolled the chain back to block 90,896,188, the last block before the attack. The move reversed about $111.2 million that had not left Cronos and returned affected balances to their pre-exploit state.</p>
<p>A validator decision on Cronos cannot rewrite transactions that have already settled on another network. Cronos said the $9.19 million that left before the halt remains beyond the rollback’s reach, leaving recovery dependent on measures outside the chain restoration.</p>
<h2 id="the-response-also-reversed-unrelated-transactions">The response also reversed unrelated transactions</h2>
<p>The rollback removed 10,961 blocks from Cronos history, covering 1 hour and 54 minutes. Every transaction recorded during that period was reversed, including transactions unrelated to Tectonic.</p>
<p>Cronos said validators made the decision after weighing the finality users expect from a <a rel="noopener noreferrer nofollow">blockchain</a> against the risk of leaving the borrowed assets under the attacker’s control. Restarting without restoring the earlier chain state would have left the position intact.</p>
<p>The important questions concern the price sources used for TONIC, the collateral and borrowing limits applied to low-liquidity assets, and the conditions under which borrowing can be paused.</p>
<p>Lending protocols can limit this type of exposure through several controls:</p>
<ul>
 <li><strong>Conservative collateral</strong> factors that cap how much can be borrowed against volatile assets</li>
 <li><strong>Asset-specific borrowing caps</strong> for low-liquidity tokens like TONIC</li>
 <li><strong>Isolated markets</strong> that contain the damage to a single pool</li>
 <li><strong>Circuit breakers</strong> that react to abnormal price movements</li>
</ul>
<p>No single control removes oracle-manipulation risk, but these measures can restrict how much value can be borrowed before a manipulated price is detected.</p>
<p>Confirmation of which safeguards were active, which ones failed and what will change would provide a clearer assessment of whether the same route could be used again. The rollback restored the chain state, but it did not by itself correct the conditions that allowed the borrowing.</p>
<h2 id="what-remains-unresolved">What remains unresolved</h2>
<p>Block production has resumed, and Cronos says its explorer, public RPC endpoints, indexers and subgraphs are operating. The network is working with exchanges, bridges and other affected services to reconcile their records.</p>
<p>Cronos says users do not need to take action while that process continues. Cronos did not identify the attacker in its post-mortem or explain how the unrecovered $9.19 million may be recovered. The rollback resolved the assets still on Cronos; the remaining amount depends on tracing and recovering funds beyond the network’s control.</p>
<p style="text-align: center;"><strong><em>This article is for informational purposes only and does not constitute financial advice.</em></strong></p>
<p>The post <a href="https://coindoo.com/why-cronos-could-recover-tectonic-exploit/" rel="noopener noreferrer nofollow">Cronos Rollback Reverses $111M, Leaves $9.2M Unrecovered</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Cronos Rollback Reverses $111M, Leaves $9.2M Unrecovered

Table of Contents

Coindoo.com

Other articles published on Sep 8, 2026

Join our free newsletter for daily crypto updates!