Key Highlights
- Cronos successfully rolled back around $111.2 million linked to the Tectonic exploit by reverting its blockchain.
- This rollback affected 1 hour and 54 minutes of transactions, impacting some unrelated activities.
- Approximately $9.19 million was withdrawn from the network before it was halted, and this amount remains unrecovered.
Cronos, the blockchain network associated with Crypto.com, took the unprecedented step of erasing nearly two hours of transaction history to counteract a $111.2 million exploit involving the Tectonic lending protocol, as detailed in a network post-mortem published on Monday.
According to the Cronos development team, validators chose to reverse completed transactions to safeguard about 92% of the funds still present in the network, a move that defied the typical expectation of permanence in blockchain transactions.
“This was a difficult choice made in collaboration with the validators, balancing the finality that users anticipate from a blockchain against the funds that were at risk,” the developers stated. “Restoring the state required discarding 1 hour and 54 minutes of finalized transactions. The alternative, restarting without restoring the state, would have left the borrowed assets under the control of the attacker.”
This difficult decision also meant that all legitimate transactions processed during that timeframe were also reversed.
The Tectonic network, targeted by hackers on August 30, allows users to borrow cryptocurrency against their deposited collateral. Reports indicate that the attacker artificially inflated the price of TONIC on decentralized exchanges with low liquidity, subsequently borrowing around $120.4 million across nine different markets using the inflated collateral.
Validators halted the Cronos network at 9:32 a.m. EST and proceeded to roll back 10,961 blocks, effectively removing 1 hour and 54 minutes of transactions.
“Every transaction in that timeframe was reversed, regardless of its connection to the exploit, and open positions on active applications were repriced when trading resumed,” Cronos explained.
However, despite the rollback, about $9.19 million had already exited Cronos before the network was halted, leaving this amount unrecoverable and outside the rollback's scope, as per the post-mortem analysis.
Initial estimates suggested the impacted value was around $75 million, with approximately $6 million bridged out. Cronos’ account indicates that the total borrowing activity reached $120.4 million, with about $111.2 million successfully reversed.
According to the post-mortem, block production resumed at 6:49 p.m. EST on August 30, following nearly nine hours offline. Validators had to coordinate several times to restart using patched software while maintaining the same transaction record.
Cronos acknowledged that communication during the shutdown was lacking, stating that the reversed transactions can now be verified through archived records instead of through public blockchain explorers.
“We understand the disruption this incident caused across the Cronos ecosystem,” Cronos noted. “With network operations back online, our focus is now on reconciling with affected platforms and learning from this incident to enhance ecosystem security.”
Other Crypto Exploits
Similar challenges have faced other networks in the wake of attacks, leading to decisions about halting operations or rolling back transactions.
In August, the Maya Protocol halted its network following an attack that exploited six software vulnerabilities and resulted in the loss of approximately $1.65 million in crypto assets. Additionally, a vulnerability in Ravencoin prompted efforts to reconstruct its blockchain, placing roughly three days of transactions at risk of reversal.
Security experts have cautioned that AI may enable attackers to identify vulnerabilities more quickly, although the post-mortem from Cronos does not suggest any AI involvement in the Tectonic attack.