Cronos restarts network after emergency halt over Tectonic exploit

Cronos has resumed block production after validators halted the network during an exploit targeting Tectonic and restored the chain state to a point before the attack.

Summary

• Cronos resumed block production after validators halted the network during an exploit targeting the Tectonic protocol.
• The chain was restored to its state before the exploit, with block production restarting from block 90,896,189.
• Cronos remains under observation, while some protocols, RPC providers, explorers and bridges may take longer to return.
• A full postmortem covering the Tectonic exploit and the network's response will be released soon.

Cronos Network said the blockchain was fully back online after the validator set coordinated an emergency halt designed to protect users while the Tectonic incident was being contained. The restart followed a rollback of the network state, effectively returning Cronos to its condition before the exploit.

Block production resumed at 23:49:01 UTC on Aug. 30 from block 90,896,189. Node operators have been instructed to restart using Cronos v1.7.8 and the latest mainnet snapshots dated Aug. 31 at 09:52 UTC.

The network remains under observation while operators check its stability. Cronos warned that some protocols, RPC providers, blockchain explorers and bridges may take longer to restore their services as individual operators complete their own checks.

The shutdown came after an exploit hit Tectonic, a decentralized lending protocol built on Cronos. Tectonic told users on Aug. 30 that it was investigating an incident and asked them not to interact with the protocol until its team confirmed that it was safe.

Cronos validators subsequently stopped block production, preventing transactions from being processed across the network while the incident was investigated.

Onchain researcher Weilin Li estimated that the exploit affected roughly $75 million after initially identifying approximately $66 million connected to the attack and later finding another attacker-controlled address holding close to $8 million. Tectonic and Cronos have not confirmed the estimated loss, making the figure provisional until the promised postmortem provides a full accounting.

Li linked the incident to manipulation of TONIC, Tectonic's governance token. According to his analysis, the attacker drove TONIC's price roughly 100 times higher within around 20 minutes and then supplied the inflated tokens as collateral to borrow other assets from Tectonic.

Tectonic's lending parameters allowed TONIC to be used with a 20% collateral factor. Li identified approximately 364.6 trillion TONIC in the attack position, which would have required the tokens to carry an inflated value of roughly $375 million to support around $75 million in borrowing.

Only a portion of the assets had left Cronos before validators stopped the network. Li estimated that around $6 million had been bridged to Ethereum, leaving most of the assets linked to the exploit on Cronos when block production stopped. Neither Cronos nor Tectonic has independently confirmed that estimate.

Crypto.com CEO Kris Marszalek said the company's app and exchange were not compromised by the Tectonic incident. Crypto.com's security team was assisting with the investigation, while Marszalek said the exchange and app continued operating normally.

Instead of restarting Cronos from the state at which validators stopped producing blocks, the network restored its state to a point before the Tectonic attack.

Cronos described the halt as a "validator-consensus emergency action" taken to protect users. Restoring the earlier state meant transactions recorded as part of the exploit after the selected restoration point would no longer form part of the restarted chain's history.

The network has not yet published the technical details behind the restoration, including the exact process validators followed to agree on the earlier state. Its postmortem is expected to provide more information about the exploit, the response and the subsequent restart.

Cronos previously upgraded its infrastructure to cut gas costs by around 90% and bring block times below one second, while daily transactions had risen roughly fourfold at the time of the upgrade, crypto.news previously reported. The network had recorded more than 100 million transactions since launch and had more than 500 developers building across its ecosystem as of November 2025.

Tectonic has long been one of the main decentralized finance applications operating on Cronos. Earlier Cronos ecosystem data identified Tectonic alongside VVS Finance, Orby Network and Veno Finance among the network's prominent protocols.

Before the exploit, Tectonic held approximately $121.7 million in total value locked and around $82.7 million in active loans, according to data cited by The Block.

The Tectonic response follows several emergency blockchain shutdowns linked to security incidents in recent weeks.

For the Tectonic incident, Cronos has not yet provided a final figure for affected assets or published the root cause of the exploit. Its forthcoming postmortem is expected to document the attack and the network's response after validators halted the chain and restored its pre-exploit state.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.