Blockchain security firms PeckShield and CertiK flagged the deposits late on Sept. 3 UTC.
PeckShield said an address labelled as the TectonicFi exploiter deposited 2,658.9 ETH into Tornado Cash. CertiK independently reported the same amount and said the funds traced back to the attacker that exploited Tectonic days earlier.
CertiK valued the ETH at approximately $6.65 million and described it as funds that had been bridged out after the attacker created roughly $120 million in bad debt using artificially inflated collateral.
Most of that accounting damage no longer exists on the current Cronos ledger because validators subsequently restored the network to a state before the attack. The Ethereum funds were different: once assets had crossed onto another blockchain, a Cronos rollback could no longer reverse them.
The movement into Tornado Cash therefore marks a new phase of the Aug. 30 exploit. Rather than sitting in an identifiable Ethereum wallet, much of the successfully extracted ETH has now entered a mixer designed to break the straightforward on-chain link between deposited and subsequently withdrawn funds.
It does not make tracing or recovery mathematically impossible, but it significantly complicates the job for investigators trying to follow the proceeds.
The original attack targeted Tectonic, a lending protocol that was one of the largest decentralized-finance applications on Cronos.
Initial estimates of the exploit varied because different researchers measured different things. On-chain researcher Weilin Li estimated roughly $75 million across attacker-linked addresses, while subsequent forensic work calculated gross withdrawals from Tectonic’s lending markets at more than $120 million. CertiK now describes the event as having created approximately $120 million of bad debt.
The mechanism involved Tectonic’s own TONIC token.
Researchers said the attacker rapidly pushed the price of the relatively illiquid token dramatically higher and then used the artificially valuable TONIC as collateral to borrow liquid assets from Tectonic’s markets. Contemporary analysis put the price increase at roughly 100-fold in around 20 minutes.
That created an unusual situation in which a thinly traded token could temporarily support tens of millions of dollars of borrowing power.
Cronos validators reacted by stopping block production altogether.
The network later described the halt as a validator-consensus emergency measure intended to protect users from the Tectonic exploit. Rather than merely restarting from where the chain had stopped, validators restored the chain state to a point before the attack.
Cronos resumed block production at 23:49:01 UTC on Aug. 30, starting again from block 90,896,189.
Independent analysis found that the intervention effectively replaced roughly 11,000 block heights, removing the attack and other transactions inside the discarded section of chain history.
That decision recovered or neutralized most of the attacker’s apparent gains on Cronos, but it could not undo transfers that had already settled elsewhere.
Exactly how much reached Ethereum depends on the tracing methodology.
CertiK says approximately $6.65 million was successfully bridged out and now links that amount to the Tornado Cash deposit. More detailed forensic work by Bitquery calculated that roughly $8.3 million crossed to Ethereum before the network halt, while another investigation identified 3,356.44 ETH reaching Ethereum. Those differences mean the 2,658.9 ETH now deposited into Tornado Cash should not necessarily be treated as the entirety of everything that may have escaped Cronos.
Tectonic initially told users not to interact with the protocol while it investigated. After Cronos resumed block production, the project said it was carrying out further checks and planned a phased reopening beginning with withdrawals and loan repayments, while new borrowing and deposits remained paused. It also said a full post-mortem was coming.
The Tornado Cash movement now makes recovery of at least the 2,658.9 ETH considerably more difficult at a time when investigators are still reconstructing the attack.
The $6.65 Million Shows Both the Power and Limit of a Blockchain Rollback
The striking number in the Tectonic exploit is approximately $120 million.
The more important number may be $6.65 million.
The first represents the scale of the economic damage the attacker was able to create inside Tectonic. The second represents what Cronos could not undo.
That difference shows why the emergency rollback was so effective from a narrow loss-containment perspective.
Once validators decided they were willing to rewrite the affected portion of Cronos history, tens of millions of dollars of attacker-controlled positions could effectively disappear from the canonical chain. Assets that had already crossed a bridge to Ethereum, however, were now governed by Ethereum’s ledger rather than Cronos’s.
Cronos could rewrite Cronos. It could not rewrite Ethereum.
The attack therefore became a race between extraction and intervention.
The attacker did not need to convert the entire inflated borrowing position into permanently recoverable money. The objective was to move as much value as possible through a bridge before validators stopped the network.
The Tornado Cash deposits suggest the portion that won that race is now being put through the next stage of fund obfuscation.
That reduces one advantage defenders initially had. Stolen crypto often remains easier to observe than stolen cash because an investigator can watch an identified wallet continuously. Funds can be flagged, exchanges warned and counterparties alerted.
A mixer attacks that visibility.
The bigger issue for Cronos is that the rescue itself raises a different question.
Rolling back the chain protected users from a very large DeFi loss, but blockchain immutability is supposed to mean that valid transactions, once finalized, are extremely difficult to reverse. Cronos demonstrated that its validator set could coordinate to choose an earlier state when the consequences of leaving the existing history intact were considered unacceptable.
For affected Tectonic depositors, that was valuable.
For people thinking about settlement finality, bridges or applications unrelated to Tectonic whose transactions fell inside the discarded period, it is more complicated.
Independent researchers found that nearly two hours of previously produced chain history were replaced. The rollback therefore did not surgically reverse one malicious transaction; it changed the history surrounding it as well.
There is also a lesson at the protocol level.
The core failure was not simply that someone found a way to move tokens around quickly. A low-liquidity collateral asset was apparently capable of supporting enormous borrowing capacity after its market price was manipulated.
A lending protocol cannot assume a quoted price represents realizable value when the market producing that price is too shallow to absorb meaningful selling.
That is why collateral limits, liquidity-aware oracles, borrow caps and circuit breakers matter just as much as smart-contract code.
Cronos’s emergency intervention prevented the accounting loss from becoming an equivalent cash loss.
But the 2,658.9 ETH entering Tornado Cash is the part of the incident that the rollback could not erase.
It is also a reminder of how short the recovery window can be: once exploit proceeds escape onto another chain and enter infrastructure designed to obscure their trail, reversing the original exploit is no longer the same thing as recovering the stolen money.
“`