Cronos Network resumed block production on Sunday after validators halted the blockchain to contain an attack on Tectonic, its largest lending protocol. In a post on X, the network said the shutdown was intended to stop the attacker from removing more funds from the ecosystem.

The chain returned at 23:49 UTC on August 30 from block 90,896,189. Its state was restored to the point recorded before the attack.

Cronos Network said validators coordinated the emergency action to protect users during the active exploit. Node operators were told to restart systems with Cronos v1.7.8 and snapshots published that morning.

The Cronos Network is producing blocks again and is fully back online. The Cronos Network halted earlier today. This was a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol. The chain state was restored to before the Tectonic exploit… — Cronos Network (@CronosNetwork) August 31, 2026

The Cronos Network is producing blocks again and is fully back online. The Cronos Network halted earlier today. This was a validator-consensus emergency action to protect users from an exploit on the Tectonic protocol. The chain state was restored to before the Tectonic exploit…

Cronos Monitors Network After Aug. 30 Tectonic Exploit

The blockchain continues to be monitored as the team works to ensure stability. Some protocols, bridges, explorers, and remote procedure call providers may need more time to resume services.

The technical postmortem has not yet been published. According to Cronos Network, the report will include details on the exploit and the restoration process.

The attacker reportedly targeted the price of TONIC, the governance token for Tectonic. The token’s value allegedly increased 100 times in just 20 minutes despite liquidity of around $1.34 million.

The attacker was then able to deposit the inflated TONIC tokens as collateral. That allowed the attacker to borrow other assets from Tectonic lending pools, which led to a large outflow.

Loss estimates have varied depending on which wallets were included. Weilin Li, an on-chain researcher, initially estimated that the attacker drained about $66 million.

Later, Li revised the estimate to about $75 million after identifying another wallet linked to the attacker. The investigation has not produced a final loss figure.

It seems @TectonicFi has been exploited for around $66M! The root cause is simple: TONIC, it's own governance token has a 20% collateral factor, with very thin liquidity. The attacker performed a Mango-market style pump-and-borrow price manipulation attack. TONIC's price surged… pic.twitter.com/cZ2QQNC9C6 — Weilin (William) Li (@hklst4r) August 30, 2026

It seems @TectonicFi has been exploited for around $66M! The root cause is simple: TONIC, it's own governance token has a 20% collateral factor, with very thin liquidity. The attacker performed a Mango-market style pump-and-borrow price manipulation attack. TONIC's price surged… pic.twitter.com/cZ2QQNC9C6

Crypto.com Platforms Remain Unaffected

On Sunday, Crypto.com CEO Kris Marszalek said the company’s exchange and app were not affected. He also said customer funds on those platforms remained safe.

There has been a security breach on a Cronos lending protocol Tectonic. Cronos team is investigating, with assistance from security team. app and exchange were not affected and are operating as usual. All funds are safe. I will… — Kris (@kris) August 30, 2026

There has been a security breach on a Cronos lending protocol Tectonic. Cronos team is investigating, with assistance from security team. app and exchange were not affected and are operating as usual. All funds are safe. I will…

Security teams from Crypto.com and Cronos Network are continuing their investigations. The inquiry will examine how the attackers exploited the TONIC protocol and gained access to assets from the lending pools.

In another update, Cronos Network said its beta app was back up for testing. More features were expected in the coming days, and the network reiterated that users’ funds were secure.

What Cronos Network Restored

Halting an entire blockchain as a security measure is an extreme response that is generally reserved for an active attack causing continued losses. According to reports, out of the $74 million that was stolen, only $6 million escaped the blockchain.

That suggests the shutdown prevented the attacker from moving most of the funds, while also giving validators time to restore the chain from a pre-attack state and keep core infrastructure aligned with the rollback. Even so, the forthcoming postmortem should help explain the hack and the different loss figures.

Cronos Network has now brought its base layer back online, while restoration to full functionality across integrated platforms remains ongoing. Developers will continue to monitor the process as the infrastructure is gradually restored.