- Cronos restarted the network from a state that predates the exploit, discarding 10,961 blocks, roughly one hour and 54 minutes of transactions belonging to everyone using the chain.
- About $6.29m of the attacker’s funds had already crossed a bridge to Ethereum before the halt. Ethereum did not roll back, so that money is untouched.
- Neither Cronos nor Tectonic has published a confirmed loss total. Third-party estimates run from roughly $74m to $119.5m.
A public blockchain is meant to be a record nobody can edit. On Sunday the validators who run Cronos, the Cosmos-based network backed by Crypto.com, edited it, agreeing to throw away nearly two hours of blocks so that the funds drained from the Tectonic lending would sit back where they started.
The reason people trust a blockchain with money is that once a transaction is in, it stays in. Cronos has now demonstrated that on a network run by a small set of validators, recent history can be rewritten if enough of them agree. Anyone who used the chain during those two hours had their perfectly ordinary transactions wiped along with the attacker’s, and nobody has yet explained what happens to them.
What Cronos has said
The announcement came from the project’s own X account at 9:31 a.m. ET on Monday, after an earlier update that morning had said only: “We’re still halted. Since the last update we’ve been working through the restart sequence with validators and security teams.”
“The Cronos Network is producing blocks again and is fully back online,” the project wrote, describing what happened as “a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol” and confirming that “the chain state was restored to before the Tectonic exploit from this morning.”
That is the project’s own framing of its own emergency, not an independent finding, and it is worth reading as such. Node operators were told to restart on Cronos v1.7.8 using mainnet snapshots taken at 09:52:00 UTC, and a “full postmortem” was promised. The same post acknowledged that “some protocols, RPC providers, explorers and bridges will take longer to come back.”
The Defiant, which checked public endpoints independently, found that more than 40 minutes after the all-clear the official RPC, the VVS Finance endpoint and evm-cronos.crypto.org were still either returning errors or serving the abandoned pre-rollback version of the chain. “Fully back online” was ahead of the infrastructure.
What a state rollback actually is
Every block on a chain like Cronos contains a batch of transactions, and each one builds on the block before it. The chain halted at block 90,907,150. It restarted from block 90,896,189, which means 10,961 blocks in between were simply discarded, and every transaction inside them ceased to have happened. On the timestamps in the official explorer that is a window of about one hour and 54 minutes.
Nothing about the underlying software makes that impossible. What normally makes it impossible is that thousands of independent parties would never all agree to it. Where a chain’s block production rests with a modest, identifiable validator set, agreement is achievable in an afternoon.
The last time a major network did this was Ethereum in 2016, after the DAO hack. That decision was contested loudly and in public for weeks, and it ended in a permanent split: the chain that reversed the theft became today’s Ethereum, and those who thought the ledger should stand carried on as Ethereum Classic. Cronos’s version happened inside roughly ten hours, and its statement does not say which validators took part, what threshold was needed, or whether anyone outside that group was consulted.
What the rollback did not fix
Rewinding Cronos only rewinds balances on Cronos. Security firm PeckShield flagged that about $6.29m of the attacker’s proceeds, 2,592.2152 ETH, had already been bridged to Ethereum before the halt. Ethereum did not roll back, so that money is beyond the reach of anything Cronos validators can vote for, and Monday’s announcement does not address it.
There is also no agreed figure for how much left Tectonic in total. PeckShield and researcher Weilin Li put the funds moved at roughly $74m to $75m. investigator MASTR argues the gross market outflow was closer to $119.5m with about $32.6m of residual bad debt, and calls the lower number “materially incomplete”. Both are third-party reconstructions. Cronos and Tectonic have confirmed neither.
Tectonic’s only public words since the incident began remain a Sunday message saying it was “aware of an incident” and asking people not to interact with the protocol. No reconciliation of who is owed what has followed. For anyone who had funds in the protocol, that means the chain is running again while the question of whether they are whole is still open, and the promised postmortem is where the answer is meant to live.
What to watch
Three things would move this on. Whether the postmortem, when it lands, includes an official loss total and an accounting of what was inside those 10,961 discarded blocks. Whether Cronos says anything about the bridged $6.29m or treats it as a closed matter. And whether the project publishes the mechanics of the “validator-consensus emergency action”, because a chain that has rewound once has established that it can, and the terms on which that happens are now part of what holding assets there involves. Our guide to self-custody covers what does and does not stay under your control in situations like this, and the DeFi section carries our earlier coverage of the halt.