Cronos has resumed block production after validators halted the network during an exploit targeting Tectonic and restored the chain state to a point before the attack.
Summary
- Cronos resumed block production after validators halted the network during an exploit targeting the Tectonic protocol.
- The chain was restored to its state before the exploit, with block production restarting from block 90,896,189.
- Cronos remains under observation, while some protocols, RPC providers, explorers and bridges may take longer to return.
- A full postmortem covering the Tectonic exploit and the network’s response will be released soon.
Cronos Network said the blockchain was fully back online after the validator set coordinated an emergency halt designed to protect users while the Tectonic incident was being contained. The restart followed a rollback of the network state, effectively returning Cronos to its condition before the exploit.
Block production resumed at 23:49:01 UTC on Aug. 30 from block 90,896,189. Node operators have been instructed to restart using Cronos v1.7.8 and the latest mainnet snapshots dated Aug. 31 at 09:52 UTC.
The network remains under observation while operators check its stability. Cronos warned that some protocols, RPC providers, blockchain explorers and bridges may take longer to restore their services as individual operators complete their own checks.
“We will be releasing a full postmortem soon,” Cronos said.
Cronos network restart follows emergency validator halt
The shutdown came after an exploit hit Tectonic, a decentralized lending protocol built on Cronos. Tectonic told users on Aug. 30 that it was investigating an incident and asked them not to interact with the protocol until its team confirmed that it was safe.
Cronos validators subsequently stopped block production, preventing transactions from being processed across the network while the incident was investigated.
Onchain researcher Weilin Li estimated that the exploit affected roughly $75 million after initially identifying approximately $66 million connected to the attack and later finding another attacker-controlled address holding close to $8 million. Tectonic and Cronos have not confirmed the estimated loss, making the figure provisional until the promised postmortem provides a full accounting.
Li linked the incident to manipulation of TONIC, Tectonic’s governance token. According to his analysis, the attacker drove TONIC’s price roughly 100 times higher within around 20 minutes and then supplied the inflated tokens as collateral to borrow other assets from Tectonic.
Tectonic’s lending parameters allowed TONIC to be used with a 20% collateral factor. Li identified approximately 364.6 trillion TONIC in the attack position, which would have required the tokens to carry an inflated value of roughly $375 million to support around $75 million in borrowing.
Only a portion of the assets had left Cronos before validators stopped the network. Li estimated that around $6 million had been bridged to Ethereum, leaving most of the assets linked to the exploit on Cronos when block production stopped. Neither Cronos nor Tectonic has independently confirmed that estimate.
Crypto.com CEO Kris Marszalek said the company’s app and exchange were not compromised by the Tectonic incident. Crypto.com’s security team was assisting with the investigation, while Marszalek said the exchange and app continued operating normally.
Chain state has been restored to before the Tectonic exploit
Instead of restarting Cronos from the state at which validators stopped producing blocks, the network restored its state to a point before the Tectonic attack.
Cronos described the halt as a “validator-consensus emergency action” taken to protect users. Restoring the earlier state meant transactions recorded as part of the exploit after the selected restoration point would no longer form part of the restarted chain’s history.
The network has not yet published the technical details behind the restoration, including the exact process validators followed to agree on the earlier state. Its postmortem is expected to provide more information about the exploit, the response and the subsequent restart.
Cronos previously upgraded its infrastructure to cut gas costs by around 90% and bring block times below one second, while daily transactions had risen roughly fourfold at the time of the upgrade, crypto.news previously reported. The network had recorded more than 100 million transactions since launch and had more than 500 developers building across its ecosystem as of November 2025.
Tectonic has long been one of the main decentralized finance applications operating on Cronos. Earlier Cronos ecosystem data identified Tectonic alongside VVS Finance, Orby Network and Veno Finance among the network’s prominent protocols.
Before the exploit, Tectonic held approximately $121.7 million in total value locked and around $82.7 million in active loans, according to data cited by The Block.
Cronos restart comes after other recent emergency chain halts
The Tectonic response follows several emergency blockchain shutdowns linked to security incidents in recent weeks.
On Aug. 25, Cosmos EVM chains were advised to request validator halts while Cosmos Labs investigated a security incident affecting users of its EVM module. KiiChain reported that more than 148.3 million KII had been drained through 18 attacks, while TAC said validators halted its network after one account was drained.
MANTRA had stopped its own network several days earlier while investigating a separate incident, freezing transactions and preventing assets from moving across the Layer 1 blockchain. Its engineering and security teams investigated the issue with external partners before the network later resumed block production.
Cronos has continued developing its network infrastructure while maintaining close links with Crypto.com. A 2025 roadmap outlined plans for tokenized equities, real estate, commodities, funds and other assets, alongside lending and decentralized finance integrations. The roadmap placed Crypto.com integration at the center of distribution plans through the exchange’s user base.
More recently, Trump Media, Crypto.com and Yorkville Acquisition Corp. terminated their planned CRO treasury venture on Aug. 7. The proposed company had originally been designed around a multibillion-dollar CRO treasury, but the parties cited prevailing market conditions and changing business and stakeholder priorities when ending the transaction.
For the Tectonic incident, Cronos has not yet provided a final figure for affected assets or published the root cause of the exploit. Its forthcoming postmortem is expected to document the attack and the network’s response after validators halted the chain and restored its pre-exploit state.
