Three Blockchains Halted in Four Days, Only Chronos Rolled Back

Chronos (CRO), Ontology (ONT), and ICON networks have consecutively halted block generation over the past four days, raising concerns about the scope of emergency powers in blockchain governance.

The responses from the three networks varied. Chronos halted its network through validator consensus after an attack on the Tectonic protocol and rolled back the chain to its state before the attack. Ontology proactively stopped block generation before confirming any malicious activity. ICON first paused the targeted contract before shutting down the entire network.

The key difference lies in whether the existing ledger was altered. Chronos changed some of the already confirmed chain states, while Ontology maintained the existing ledger and halted the processing of new transactions. ICON's halt occurred after some assets had already moved to the custody area of exchanges before the complete shutdown.

The Chronos network announced in an X post that it resumed block generation at 8:49:01 AM KST on August 31 at block height 90,896,189. Chronos explained this as an emergency measure based on validator consensus, stating that it restored the chain state to before the Tectonic attack.

This measure excluded not only the state related to the attack but also other transactions that occurred after the recovery point from the main chain record. A rollback in blockchain refers to the action of removing records from the official ledger after a specific point in time, which creates a conflict between security responses and transaction finality.

The issue at hand is more about the boundaries of authority than the scale of losses. TRM Labs estimated that approximately $75 million (around 101.2 billion KRW) in assets were affected by this attack, with about $6 million (around 8.1 billion KRW) moving to Ethereum (ETH). While Chronos's rollback may affect the state remaining within the chain, it does not impact assets that have already moved to Ethereum.

Ontology's response was more about securing time. In an official announcement on August 31, Ontology stated that its core development team discovered potential risks during routine security checks and immediately halted mainnet block generation. An additional announcement on September 1 confirmed the detection of malicious attack activities but stated that there were no losses of user assets.

Ontology did not cancel the already confirmed chain state but stopped the confirmation and settlement of new transactions. However, the final authority to decide on emergency halts, the criteria for activation, and the threshold for validator consensus were not specifically outlined in the announcement. From the user's perspective, delays in remittances and on-chain adjustments occurred before any asset losses.

The ICON case demonstrated that halting the chain does not always lead to loss prevention. The ICON Foundation reported in a post-incident report that the attacker retransmitted two previously valid withdrawal messages 1,492 times between 11:01:02 AM and 11:21:12 AM KST on August 27. Of these, 1,490 attempts were successful, resulting in the transfer of 119,866,000 ICX and 531,600 bnUSD from the foundation's asset pool to the attacker's wallet.

ICON's monitoring alert was triggered within seven minutes after the first attack. However, the technical investigation did not begin until around 12:40 PM, and the related contracts were halted at 12:53 PM. Exchanges suspended ICX deposits and withdrawals starting at 2:54 PM, and the complete network shutdown occurred at 3:18:54 PM. ICON resumed operations around 4:51 PM on August 28.

The ICON Foundation stated that all related assets were held by the foundation and that general user deposits, balances, and positions were unaffected. According to the report, 531,600 bnUSD and 1,366,000 SODA were fully recovered. Of the 113,634 USDC, 82,430 were recovered, while 31,204 were not. The confirmed net loss was presented as approximately 150.2 ETH and 31,204 USDC.

While the three incidents are linked by the same block generation halt, the outcomes were different. Chronos reduced risks within its main chain by rolling back chain records, Ontology secured time for investigation and upgrades by halting transaction processing, and ICON rebuilt its network after the attack, but assets that had already moved to the custody area of exchanges were difficult for the chain operator to control directly.

Halting block generation is an action of not creating new blocks, while a rollback is the action of excluding the chain state after a specific point from the official record. Both methods are emergency responses, but their impacts on users differ. The former leads to transaction delays and service interruptions, while the latter leaves questions about transaction finality itself.

For domestic investors, the implications of this case are significant. A mainnet halt is not merely a failure but an event that reveals transaction finality, bridge assets, centralized exchange custody, and validator authority all at once. Previously, the Harmony protocol also pursued a network rollback after a large-scale exploit, leaving the question of how far chain records can be rolled back after a security incident as a recurring issue.

The key points that each network must disclose are who decided to halt, what criteria were used to choose rollback or suspension, and who is responsible for assets that have moved outside the chain. The final loss tally and post-incident report from Chronos and Tectonic have yet to be made public.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.