Cronos says $9.19 million remains lost after rollback

The rollback recovered most of the borrowed funds. It did not recover all of them.

Cronos’ post-mortem confirms that an attacker manipulated collateral on Tectonic, then borrowed $120.4 million across nine markets on Aug. 30. The post-mortem account reported by The Block says $9.19 million had already left the chain before validators halted the network and remains beyond the rollback’s reach.

That unrecovered amount works out to 7.6% of the total borrowed funds: $9.19 million divided by $120.4 million. Cronos’ post-mortem does not say what will happen to the unrecovered funds.

The attack began with TONIC, Tectonic’s thinly traded governance token. According to Cronos’ account, the attacker deployed contracts and drove up TONIC’s price, then used the inflated collateral to borrow $120.4 million from the protocol’s nine markets.

Cronos identified the malicious activity about 36 minutes after the attack. Validators halted the network at block 90,907,150 and rolled it back to block 90,896,188, which Cronos identified as the last block before the attack.

That restoration discarded 1 hour and 54 minutes of chain history, equal to 10,961 blocks. It reversed roughly $111.2 million of the borrowed funds. Block production resumed about 11 hours after the attack began.

Cronos framed the rollback as a choice between chain finality and funds still at risk. “It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk,” the Cronos team wrote in the post-mortem.

The team also described the alternative: “The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.” That explains the rationale for reversing the chain history, while leaving the separate $9.19 million exposure unchanged.

The distinction matters for positions tied to the affected chain. Transactions inside the discarded 10,961 blocks were reversed by the restoration, while assets that had already left Cronos before the halt were outside its reach. Cronos’ account states that the $9.19 million “has not been recovered and is beyond the restoration’s reach.”

The event’s first estimate was covered in Crypto Desk’s earlier report on the Cronos halt. The post-mortem now supplies the final split between the amount reversed and the amount still missing: $111.2 million restored against $9.19 million exfiltrated.

The attacker was not named in the account. Cronos also gave no recovery timetable for the remaining funds. CRO edged up 0.62% over the past 24 hours to $0.058, a market datapoint that does not alter the post-mortem’s accounting of user losses.