Crypto.com supported public chains. Cronos revealed that due to an attack on the lending protocol Tectonic, network validators rolled back nearly two hours of historical data on the chain. Cronos stated that this action reversed approximately $111.2 million worth of related transactions, preserving most of the funds still on the chain, but it also canceled all legitimate transactions that occurred during that period as well.
The attack occurred on August 30th.
According to the post-event review published by Cronos, on August 30th, attackers took advantage of the insufficient liquidity in decentralized trading markets to drive up the price of TONIC. They then used the inflated value of the collateral to borrow approximately $120.4 million in assets across 9 markets of Tectonic.
According to Cronos, the validators suspended the network at 9:32 a.m. Eastern Time on that day, and subsequently rolled back 10,961 blocks, erasing transaction records covering a period of 1 hour and 54 minutes. The network resumed block generation at 6:49 p.m. that same day, with a total downtime of approximately 9 hours.
Approximately 92% of the affected funds remain on the blockchain.
Cronos indicates that the decision to roll back was made because approximately 92% of the affected funds were still on the network at that time. If the system is not restored to its state before the attack, the related borrowed assets will continue to be under the control of the attackers.
However, this approach also breaks users' common expectation that blockchain transactions are irreversible. Cronos admitted during a review that every confirmed transaction within the rollback window, regardless of whether it was related to the attack or not, was revoked; in some applications, unclosed positions were also re-priced after the transactions were restored.
There are still $9.19 million that have been transferred out.
Although the rollback canceled most of the related operations, according to Cronos, approximately $9.19 million had already been transferred out of the network before the chain was halted. This amount of funds is not within the scope that can be covered by the rollback, and it has not yet been recovered to this day.
Previously, external estimates suggested that the affected amount was around 75 million US dollars, with approximately 6 million US dollars transferred across chains. Cronos This time, the revised figures are higher, stating that the total borrowing amount was about 120.4 million US dollars, of which about 111.2 million US dollars have been revoked.
Cronos acknowledges insufficient communication during the downtime
Cronos indicates that before the network restart, the verifiers conducted multiple rounds of coordination and resumed operations based on the same transaction records after repairing the software. The project team also acknowledges that there was insufficient communication with external parties during the downtime.
For revoked transactions, as Cronos states, users can now query through archived records, but these records will no longer be displayed in the mainchain history of public blockchain browsers.
Additional information:Similar measures are not a first occurrence. Maya Protocol has previously suspended the network after attacks, and Ravencoin has also faced the pressure of having to rebuild the chain history due to vulnerabilities.
