Spain’s largest cryptocurrency exchange Bit2Me has launched a separate company to help courts, police and financial institutions trace, seize, store and liquidate cryptocurrency linked to investigations.

According to a statement from Bit2Me, the new unit, Bit2Shield, has been legally registered as CryptoShield S.L. and will provide forensic and operational services covering digital assets from the point they are identified during an investigation through their eventual sale when ordered by authorities.

The company will assist investigators during searches and seizures by extracting information from wallets, locating cryptocurrency and preparing digitally signed forensic reports that can be submitted in court. Its work will extend to fraud investigations, source-of-funds certification and training for police officers, judges and financial institutions.

Bit2Shield formalizes services that Bit2Me had already been providing to government agencies. During 2025, the exchange processed €1.5 million ($1.74 million) in seized cryptocurrency for authorities including Interpol, Europol and Spanish police, according to the company.

Blockchain analytics provider Chainalysis was used to trace the assets before Bit2Me converted the cryptocurrency into euros for the state.

Bit2Shield will manage crypto from seizure to sale

Once digital assets have been located and seized, Bit2Shield will arrange their storage in cold wallets protected by a multi-signature setup, Bit2Me said. The assets can remain under custody until authorities issue instructions for their disposal.

When a court or another competent authority orders a sale, Bit2Shield will coordinate the process, while the actual crypto-to-euro conversion will be carried out through Bitcoinforme S.L., Bit2Me’s entity authorized by Spain’s securities regulator under the European Union’s Markets in Crypto-Assets framework.

Proceeds from the sale will then be transferred in euros to government bank accounts.

Bit2Me said Bit2Shield itself is not a crypto-asset service provider under MiCA because its activities center on investigations, digital forensics and training. Services that fall under the regulated conversion of cryptocurrency into fiat will remain with Bitcoinforme.

The distinction comes after the EU completed the final stage of its MiCA transition period on July 1. As crypto.news previously reported, only 281 of 1,343 crypto service providers operating across the European Economic Area had secured MiCA authorization by the deadline, leaving 1,062 without approval.

An Aug. 5 review of ESMA authorization data found that the regulator’s interim register is updated weekly and covers regulated activities including custody, crypto-to-fiat exchange, trading platforms, transfers, order execution and portfolio management. The data has since been made available through a searchable MiCA tracker for firms and compliance teams.

Bit2Me has expanded its work with banks

The new forensic unit follows Bit2Me’s expansion into infrastructure used by traditional financial institutions, alongside its retail cryptocurrency exchange business.

In June, Spanish banking group Cecabank launched a regulated crypto platform for financial institutions after securing authorization for crypto custody, transfers and the reception and transmission of orders.

Bit2Me handles trade execution, liquidity, market access and the exchange layer under that arrangement, while Cecabank provides institutional custody and banking infrastructure. Renta 4 Banco became one of the first financial institutions to use the platform as it developed crypto trading services for clients.

The project grew out of a partnership established in May 2024. The two companies initially announced the MiCA-ready infrastructure in May 2025 while they were waiting for regulatory approval, with Bit2Me assigned responsibility for trading and market access.

Cecabank later began the European passporting process to extend its authorized crypto services into Ireland, Portugal and Luxembourg.

Bit2Me’s shareholders and financial backers include companies from both banking and crypto. Tether acquired a minority interest in the Spanish exchange in 2025 and led a €30 million funding round intended to support its expansion in Europe and Latin America. The Tether investment followed Bit2Me’s receipt of authorization under MiCA, allowing it to operate across EU member states.

Bankinter, Unicaja, Cecabank and Telefónica are among the other companies that have backed Bit2Me.

Crypto seizures require specialized custody

Bit2Shield is entering a field where police agencies have increasingly turned to specialized crypto companies to manage digital assets after seizure.

South Korea’s National Police Agency, for example, awarded Upbit operator Dunamu a one-year contract in August to custody seized cryptocurrency after a public tender. Under that arrangement, confiscated assets are stored through Upbit Custody using offline cold wallets, with separate wallets for different types of assets and security based on multi-party computation, distributed key generation and multi-signature technology.

Spanish authorities have faced the same operational issue when cryptocurrency is recovered during criminal investigations. In April, National Police officers seized approximately €400,000 in crypto held in two cold wallets during an investigation into a manga piracy operation in Almería. The cold wallets were concealed inside a wall-mounted thermometer, according to police.

The case involved a Spanish-language manga piracy platform that authorities said had operated for roughly a decade and generated more than €4 million in advertising revenue since 2014. Three people were arrested during the operation.

Blockchain tracing can remain useful after investigators identify or recover digital assets because transactions leave records that can be followed across public networks. Chainalysis said in August that investigators can trace funds even in cases involving physical cryptocurrency theft, while its research documented more than $30 million stolen through successful kidnappings, home invasions and other violent attacks during the first half of 2026.

In a separate investigation disclosed in August, Chainalysis traced 29,120 cryptocurrency addresses and digital identifiers connected to more than 100 child sexual abuse material platforms, forums and distribution networks. The work generated 14,300 investigative leads and identified more than 7,700 suspect accounts across cryptocurrency exchanges and payment platforms.

Bit2Shield’s investigations will be led by Adrián Maroño, a former member of the Spanish Civil Guard’s Central Operational Unit, known as UCO. His responsibilities will cover the forensic and investigative work carried out by the new company for courts, law enforcement agencies and financial institutions.

The CHFD stablecoin entered its formal testing phase on Sept. 8 after Swiss financial market operator SIX and payments provider TWINT joined seven existing participants in the controlled initiative.

The nine participants are UBS, PostFinance, Sygnum, Raiffeisen, Zurich Cantonal Bank, Banque Cantonale Vaudoise, SIX, TWINT and Swiss Stablecoin AG, according to the official announcement.

They are testing a digital asset designed to maintain a one-to-one value against the Swiss franc. One CHFD is intended to equal one CHF inside the sandbox.

The project remains experimental. Its members said the testing does not represent a decision to issue CHFD commercially or make it available to the public.

CHFD stablecoin tests move beyond basic transfers

The participating institutions will test automated transactions between financial firms and the settlement of tokenized assets. These are established institutional use cases for blockchain-based money.

A stablecoin could allow a tokenized security and its payment to move through connected digital systems. The objective would be to reduce the delay between the delivery of an asset and receipt of the corresponding funds.

SIX already operates infrastructure for issuing, trading and settling digital securities. Its digital asset platform supports tokenized securities alongside traditional assets in a regulated post-trade environment.

More than CHF2 billion in digital securities have been issued through SIX Digital Exchange, according to the company. Some transactions have settled using the Swiss National Bank’s wholesale central bank digital currency under Project Helvetia.

The CHFD participants will also study programmable payments, where predetermined conditions control when funds move. The proposed scenarios cover e-commerce, ticketing and public-sector payments.

For online marketplaces, the institutions will examine whether payment conditions can reduce fraud. A transaction could potentially release money only after agreed requirements have been satisfied.

In ticketing, the group will test whether programmable rules can support fairer access to events. The announcement did not identify participating ticket companies or explain what those controls would involve.

The public-funds scenario will assess whether conditional payments can make disbursement more efficient. No Swiss government agency was named as a participant, and the announcement does not confirm that public money is already moving through CHFD.

SIX and TWINT broaden the sandbox’s reach

SIX contributes experience in exchanges, securities settlement, custody and institutional digital assets. Its participation could help connect the payment side of CHFD with tokenized bonds, funds or other financial instruments.

Switzerland’s tokenized securities market is already processing large transactions. In related coverage, a CHF350 million digital bond was issued through SIX infrastructure, showing how regulated blockchain settlement is moving beyond small trials.

The institutions have not announced a production connection between CHFD and SIX Digital Exchange. Such an integration remains one of several possibilities being assessed.

TWINT brings expertise in consumer and merchant payments. Its mobile payment system is widely used in Switzerland for person-to-person transfers, online purchases and physical retail transactions.

TWINT’s involvement gives the initiative a participant focused on everyday payments rather than only banking and securities infrastructure. However, there is no confirmed plan to offer CHFD through the TWINT application.

The announcement also does not mean that customers of UBS, PostFinance, Sygnum, Raiffeisen, ZKB or BCV can access the token. Participation remains restricted to authorized institutions inside the controlled environment.

The sandbox began with six Swiss banks in April

UBS, PostFinance, Sygnum, Raiffeisen, ZKB and BCV originally launched the initiative with Swiss Stablecoin AG in April 2026. As crypto.news reported at the time, six major Swiss banks opened the stablecoin sandbox to examine potential applications in payments and tokenized finance.

The original initiative remained open to additional banks, companies and institutions. The arrival of SIX and TWINT expands the group from seven participating companies to nine. CHFD became technically operational inside the sandbox at the end of June. The Sept. 8 announcement marks the start of coordinated testing across the expanded group rather than the token’s first technical deployment.

CHFD Infrastruktur AG operates the platform used for the trials. The company is a subsidiary of Swiss Stablecoin AG.

The sandbox uses a limited participant group, transaction caps and other safeguards intended to contain financial and operational risks. These restrictions distinguish it from a public stablecoin circulating freely through exchanges and personal wallets. Calling the system a “live environment” means participants can test actual technical processes under controlled conditions. It does not mean CHFD has been approved for unrestricted commercial distribution.

CHFD is not a public Swiss franc stablecoin

The participants have not published a public token contract, circulation figure or exchange listing. Retail users have not been invited to buy, redeem or transfer CHFD.

No public reserve attestation accompanied the Sept. 8 announcement. The group said only that CHFD is structured to maintain a one-to-one peg with the Swiss franc.

A commercial stablecoin would need clear rules covering issuance, redemption, reserves, customer identification, transaction monitoring and the treatment of holders if the operator failed.

FINMA’s stablecoin guidance says the regulatory treatment of a Swiss stablecoin depends on its legal structure and the rights granted to holders. Anti-money laundering requirements can also apply because stablecoins may serve as payment instruments.

The current sandbox does not constitute a broad FINMA endorsement of CHFD. The participating institutions must assess the technical, regulatory and operational requirements before making any decision about wider issuance.

CHFD is also separate from the Swiss National Bank’s wholesale central bank digital currency. A wholesale CBDC represents central bank money for eligible financial institutions, while CHFD would carry claims and risks determined by its private issuance structure.

The Swiss National Bank has separately tested wholesale digital francs through Project Helvetia. Crypto.news previously reported that Switzerland extended its wholesale CBDC pilot to cover more institutions and financial transactions.

Switzerland already has competing digital francs

CHFD is entering a market where other Swiss franc-denominated digital assets already operate. These include AllUnity’s CHFAU, VNX’s VCHF and the decentralized Frankencoin.

BitGo added institutional access to CHFAU through a partnership with AllUnity. CHFAU is separate from CHFD and follows a different regulatory, issuance and distribution model.

The CHFD group’s possible advantage comes from its links to Swiss banking, mobile payments and securities infrastructure. UBS, PostFinance, Raiffeisen, ZKB and BCV provide banking reach, while SIX and TWINT add market and payment networks.

Those relationships do not guarantee adoption. The partners have not disclosed how much CHFD has been issued, how many transactions have been completed or how the platform compares with existing payment systems.

UBS has prior experience with blockchain-based money. The bank previously completed cross-border payment trials using UBS Digital Cash across Swiss francs, euros, U.S. dollars and Chinese yuan.

The earlier UBS system and CHFD are separate projects. Their common focus is the use of programmable digital money for institutional settlement and payments.

There was no identifiable cryptocurrency market reaction to the CHFD announcement. The sandbox has no publicly traded native token, while CHFD itself does not have a reported public market price.

Testing will continue through the end of 2026

The partners expect testing to continue until the end of 2026. They described the initiative as open-ended, meaning it is not designed to guarantee a commercial launch.

The trials will assess where a Swiss franc stablecoin could offer practical value and which technical, operational and regulatory obstacles remain.

The institutions plan to publish an overview after the initiative concludes. They have not provided an exact publication date or committed to releasing transaction-level data.

A broader launch would require a separate decision after the results are assessed. The participants have not announced a retail rollout, bank-account integration or exchange listing.

XRP received new mainstream exposure on Sept. 7 when the Kansas Jayhawks football program shared a season-opening video featuring the cryptocurrency following its 51-6 victory over Long Island University.

The footage came from Kansas’ Sept. 4 game at David Booth Kansas Memorial Stadium. It marked one of the first prominent football appearances for XRP since Kansas Athletics signed a multi-year sponsorship agreement with Ripple in July.

The official Kansas Football post included an XRP mention alongside scenes from the victory. The appearance was part of an existing commercial partnership rather than a separate endorsement announced after the game.

Kansas improved to 1-0 with the win. Long Island fell to 0-2. The result itself had no demonstrated connection to XRP’s market price or activity on the XRP Ledger.

XRP branding follows Kansas’ dominant opening win

Kansas produced 613 total yards against Long Island, according to the university’s official boxscore. The Jayhawks recorded 277 rushing yards and 336 passing yards while controlling possession for more than 33 minutes.

Long Island finished with 146 total yards, including 35 rushing and 111 passing. Kansas converted eight of its 13 third-down attempts, while its opponent converted two of 13.

Quarterback Isaiah Marshall completed 14 of 19 passes for 246 yards and two touchdowns. He added 49 rushing yards as Kansas built a 30-0 halftime lead.

Running back Yasin Willis carried the ball 11 times for 72 yards and two scores. Micah Johnson, Jalen Dupree and Donald Collier also recorded rushing touchdowns.

Receiver Nik McMillan caught six passes for 130 yards and one touchdown. Tate Nagy added the first touchdown reception of his college career.

The Kansas Athletics recap described the game as a comprehensive opening victory. XRP branding gained visibility through Kansas’ uniforms and subsequent social media content surrounding the result.

Ripple’s Kansas agreement covers every athletics team

Kansas Athletics announced its partnership with Ripple on July 8. Jayhawk Sports Properties, the university’s local Learfield division, helped arrange the agreement.

An XRP patch will appear on uniforms across all Kansas Athletics teams. Kansas described the arrangement as the first integration of a cryptocurrency into the jerseys of a major college athletics program.

The university’s announcement did not disclose the sponsorship’s financial terms. It described the deal only as multi-year.

Crypto.news previously reported that Ripple secured a five-year Kansas sponsorship, expanding XRP’s visibility across a major NCAA Division I athletics program.

The partnership also includes financial and technology education for student-athletes and the wider campus community. Kansas said the programs would cover traditional finance, digital assets and blockchain technology.

Ripple and Kansas also plan to support career opportunities connecting graduates with the technology sector. The organizations have not published a schedule for individual classes, events or recruitment programs.

Ripple CEO Brad Garlinghouse is a University of Kansas alumnus. He grew up in Topeka, giving the company’s sponsorship a direct connection to the state and university.

The university has not said that student-athletes will receive XRP, use the XRP Ledger or promote cryptocurrency investments. The confirmed agreement focuses on branding, education and career development.

Kansas expands the XRP partnership beyond jerseys

Kansas Athletics launched the Rock Chalk Fan Club on Sept. 2 as another part of its digital engagement strategy. The university described the online community as being “championed by XRP.”

The fan club offers access to exclusive material, merchandise opportunities and other member benefits. Kansas has not announced that membership requires cryptocurrency or an XRP wallet.

That distinction matters because visible XRP branding does not automatically mean the university is adopting the asset as a payment method. Kansas has not confirmed ticket, merchandise, concession or donor payments in XRP.

The partnership nevertheless puts the token’s name before audiences beyond conventional cryptocurrency markets. College athletics reaches students, alumni, television viewers and supporters who may not interact regularly with blockchain products.

Ripple’s sports strategy also creates a separation between the company and the token being promoted. Ripple develops blockchain-based financial services and holds XRP, while XRP operates as the native asset of the open-source XRP Ledger.

The branding arrangement specifically features XRP rather than only Ripple’s corporate name. It therefore gives the digital asset direct exposure in a regulated and commercially established U.S. sports environment.

Florida becomes Ripple’s second college sports partner

Ripple expanded its college sports presence on Sept. 4 by announcing a separate multi-year agreement with Florida Athletics.

Under that deal, the XRP logo appears prominently on the field at Ben Hill Griffin Stadium. Branding will also feature across Florida Athletics’ digital properties, event signs and other promotional areas.

The official Florida Athletics release confirmed that Ripple will support financial and technology education for student-athletes and members of the campus community.

In related coverage, Florida placed XRP branding inside its football stadium as Ripple widened its U.S. college athletics campaign beyond Kansas.

The Kansas and Florida agreements use different branding placements. Kansas places XRP patches on team uniforms across its athletics department, while Florida features the logo on its football field, signs and digital channels.

Neither university disclosed the value of its agreement. Ripple also has not said whether it plans to add more college athletics partners during the 2026 season.

Kansas’ next football game is against Missouri on Sept. 11 at 7 p.m. Central Time. The Border Showdown will provide another public appearance for the XRP-branded uniforms.

XRP traded near $1.38 on Sept. 8, down approximately 2% over 24 hours. No verified market data links that movement to Kansas’ video, its victory or Ripple’s college sports sponsorships.

Germany’s debate over Bitcoin taxation has gained a new political dimension after the Alternative for Germany won nearly 44% of the vote in Saxony-Anhalt, months after the party opposed plans to remove the country’s one-year crypto tax exemption.

Reuters reported that the AfD secured 39 of the 83 seats in the state parliament, leaving the party three seats short of an outright majority but well ahead of Chancellor Friedrich Merz’s Christian Democratic Union.

The AfD received 43.8% of party-list votes and 44.3% of first votes across 2,661 polling districts. The CDU fell to 17.2% of party-list votes, almost 20 percentage points below its result in the 2021 election, while voter turnout reached 77.8%, up 17.5 percentage points.

The state election does not give the AfD additional seats in the Bundestag or allow Saxony-Anhalt to change Germany’s federal crypto tax rules. It does, however, give the party another political platform while the federal government prepares legislation that could change how long-term cryptocurrency gains are taxed from 2027.

AfD win strengthens a vocal opponent of Germany’s Bitcoin tax plan

Merz ruled out cooperation with the AfD after the result, telling reporters that the election had shaken the CDU “to its very foundation,” Reuters reported.

AfD co-leader Tino Chrupalla called on CDU lawmakers to work with his party to create what he described as a “center-right conservative majority.” Such an arrangement would break the long-standing political firewall under which Germany’s mainstream parties have refused to cooperate with the AfD.

The AfD’s Saxony-Anhalt branch has been classified as right-wing extremist by the state’s domestic intelligence agency. Reuters described the party as anti-immigration and pro-Russia, while co-leader Alice Weidel called the election result a breakthrough and said the AfD was targeting at least 40% of the vote in Germany’s 2029 federal election.

Crypto taxation has formed part of the party’s economic agenda since before its Saxony-Anhalt victory.

In an October 2025 Bundestag motion, the AfD described Bitcoin as a “decentralized, non-manipulable, and limited-availability digital asset” that it argued should be treated differently from other cryptocurrencies.

The party called for Bitcoin to be excluded from the European Union’s Markets in Crypto-Assets framework and asked the federal government to preserve the 12-month holding period for privately held Bitcoin. It proposed that private Bitcoin mining and Lightning node operations should not automatically be classified as commercial activities.

Germany’s one-year crypto tax exemption remains in place

Germany currently treats privately held cryptocurrencies as other assets under its income tax rules. Gains are taxable when the period between acquisition and disposal is no more than one year, while disposals after the holding period are generally outside the private-sale tax regime.

Berlin has been preparing to change that treatment.

As crypto.news previously reported, Finance Minister Lars Klingbeil said in April that the government intended to tax cryptocurrencies differently as part of its 2027 budget plans.

The federal cabinet’s 2027 budget plan subsequently confirmed that legislation covering the taxation of crypto assets would be introduced. Klingbeil said in July that his ministry was working on the proposal and wanted cryptocurrency income to be taxed in the same way as other income, although the government had not yet released the final mechanism.

Germany’s Green Party had already tried to remove the holding-period benefit earlier in the year.

A proposal advanced by the Greens on May 6 sought to make gains from private crypto disposals subject to personal income tax regardless of how long the assets had been held. The party based its revenue case on a Frankfurt School study that estimated an additional €11.4 billion could be raised, while using only half of that figure in its own calculations to account for uncertainty.

The proposal failed in the Bundestag Finance Committee on May 20 after lawmakers from several parties opposed it. The committee rejected the plan, leaving the existing holding-period treatment intact.

The AfD opposed the Greens’ proposal and argued that the government should tax fewer activities while concentrating spending on core state functions. CDU/CSU and SPD lawmakers opposed the proposal for separate reasons.

Germany’s crypto tax debate covers billions in on-chain activity

The tax dispute is taking place in one of Europe’s largest cryptocurrency markets.

Chainalysis estimated that Germany generated $24.1 billion in potentially taxable on-chain crypto activity during 2025, second only to the United States among individual countries covered by its analysis.

The figure consisted of $15.6 billion in payments, $6.1 billion in realized gains and $2.4 billion in income. Chainalysis cautioned that its calculations represented activity that could potentially fall within commonly used tax rules, not the amount of tax owed or unpaid.

Globally, potentially taxable activity exceeded $457 billion in 2025, according to the analytics firm. Transactions falling within the practical reach of the OECD’s Crypto-Asset Reporting Framework accounted for only 14% of the total identified activity.

Germany has separately remained one of Europe’s largest markets by total crypto value received. Chainalysis recorded $219.4 billion flowing into the country between July 2024 and June 2025, representing a 54% increase from the previous comparable period.

A survey of roughly 6,000 investors across Germany, France, Italy and Spain found that 25% of German respondents had already invested in digital assets. Nearly half of respondents across the four countries said the EU’s MiCA framework had made digital assets feel safer and more accessible.

Regulated crypto infrastructure has continued to expand alongside that activity. Germany had 79 authorized crypto asset service providers under MiCA by August, after six cooperative banks joined the European Securities and Markets Authority register. France had 35 authorized providers at the time, while the Netherlands had 29.

Federal lawmakers will decide any Bitcoin tax change

Despite the scale of the AfD victory in Saxony-Anhalt, Germany’s federal tax treatment of cryptocurrency cannot be changed by the state government.

Any removal or modification of the one-year holding rule would have to move through the federal legislative process after the Finance Ministry releases its proposal.

The government has committed to introducing legislation on crypto taxation as part of its 2027 fiscal plans. Klingbeil said during a July press conference that the ministry was working on the measure and expected a concrete bill, but declined to disclose its provisions before the government’s internal coordination process had been completed.

The AfD, meanwhile, has already put its preferred treatment into a Bundestag proposal. Its October 2025 motion called for the 12-month Bitcoin holding period to be preserved reliably, sought a legal distinction between Bitcoin and other crypto assets, and proposed keeping private mining and Lightning node activity outside commercial classification.

With 39 seats in Saxony-Anhalt’s 83-seat parliament, the party now faces the separate question of whether it can assemble enough support to govern the state. Chrupalla has urged CDU lawmakers to cooperate, while Merz has maintained that his party will not form an alliance with the AfD.

Cronos has confirmed that $9.19 million remains unrecovered after an attacker borrowed $120.4 million from Tectonic, while a validator-backed rollback reversed roughly $111.2 million in affected value.

According to a post-mortem published by Cronos on Monday, the attacker manipulated the price of TONIC, the governance token of lending protocol Tectonic, and used the inflated asset as collateral to borrow funds across nine markets on Aug. 30.

The attack led Cronos validators to halt the Layer 1 blockchain at block 90,907,150 before agreeing to restore the network to block 90,896,188, the final block produced before the exploit began.

The rollback returned affected balances to their pre-attack state and reversed approximately $111.2 million of the $120.4 million involved in the incident. However, funds that had already moved away from Cronos were outside the reach of the restoration.

“The $9.19 million that left Cronos before the halt has not been recovered and is beyond the restoration’s reach,” the team said.

Cronos rollback restored $111.2 million after Tectonic exploit

The rollback discarded 10,961 blocks, representing 1 hour and 54 minutes of Cronos transaction history, according to the post-mortem. Transactions completed during that window were reversed regardless of whether they had any connection to the Tectonic attack.

Cronos said validators had to weigh transaction finality against the amount of money still exposed when deciding how to restart the network.

“It was a hard decision, taken together with the validators, weighing the finality users expect from a chain against the funds at risk,” Cronos said. “The alternative, restarting without restoring state, would have left the borrowed assets in the attacker’s control.”

The final accounting substantially raises the value involved compared with early estimates published immediately after the incident. On Aug. 31, crypto.news reported the Cronos halt after onchain researcher Weilin Li initially estimated that approximately $75 million had been affected.

Li’s early analysis found that most of the identified funds remained on Cronos when validators stopped block production, while roughly $6 million was believed to have reached Ethereum. At the time, neither Tectonic nor Cronos had released a final accounting of the assets involved.

Blockchain data provider Bitquery subsequently calculated that $120.4 million had been removed from Tectonic’s lending markets, a figure that is consistent with the amount detailed in Cronos’ post-mortem.

TONIC price manipulation allowed $120.4 million in borrowing

Cronos said the attack began after contracts were deployed to manipulate the market price of TONIC, a thinly traded token that Tectonic accepted as collateral.

Once the token’s price had been driven higher, the attacker supplied the inflated collateral to the lending protocol. Roughly 10 minutes later, $120.4 million had been borrowed across nine Tectonic markets.

Early onchain analysis had found that TONIC’s reported price increased approximately 100-fold within around 20 minutes. The token carried a 20% collateral factor on Tectonic, allowing borrowers to take loans against part of the value assigned to their deposited TONIC.

RedStone co-founder Marcin Kazmierczak later told crypto.news that the incident was not an oracle failure. He said the oracle accurately reported the TONIC price in the market it monitored, while Tectonic accepted that price without adequately accounting for whether enough liquidity existed to sell the collateral at the reported valuation.

Kazmierczak identified borrow caps tied to executable liquidity as one safeguard that could have restricted the amount available to borrow even if TONIC’s reported market price increased sharply. Dynamic collateral factors, minimum market-depth requirements and price-impact limits could have provided other controls, he said.

Tectonic had roughly $121.7 million in total value locked and approximately $82.7 million in active loans before the exploit, according to figures cited during the initial investigation.

Validators halted Cronos within an hour of the attack

The post-mortem provided a more detailed timeline of the network’s response.

After the attacker began manipulating TONIC and borrowing against the inflated collateral, Cronos identified the malicious activity roughly 36 minutes later. Validators subsequently halted the blockchain, preventing further transactions while the incident was investigated.

The network was eventually restored to its pre-exploit state before block production resumed around 11 hours after the attack began.

When Cronos restarted block production on Aug. 30, the chain resumed from block 90,896,189 after validators coordinated the emergency restoration. Node operators were instructed to restart using Cronos v1.7.8 and updated mainnet snapshots.

Crypto.com CEO Kris Marszalek said during the incident that the company’s centralized app and exchange continued operating and were not compromised. Crypto.com and Cronos are closely associated, while Tectonic operates as a decentralized lending protocol on the blockchain.

The rollback meant infrastructure providers connected to Cronos had to reconcile their systems with the restored chain state. RPC providers, explorers, indexers, subgraphs and bridges needed to synchronize with the version of the blockchain that replaced the discarded blocks.

A subsequent crypto.news analysis examined how validators rolled back the chain and erased more than 10,000 blocks to restore its state. The action removed transactions belonging to regular users during the same period alongside those connected to the attacker.

$9.19 million remains outside Cronos restoration

Cronos’ post-mortem now puts the amount that escaped the restoration at approximately $9.19 million, equal to 7.6% of the $120.4 million affected.

Funds that remained within the network could effectively be returned to their earlier state through the rollback. Assets already transferred away from Cronos could not be reversed through changes to the chain’s own transaction history.

The Tectonic incident accounted for more than half of the estimated cryptocurrency losses recorded during August. Blockchain security firm PeckShield counted 50 major crypto hacks during August, with estimated losses totaling $136.3 million. Its earlier calculation placed the Tectonic incident at approximately $74 million because the final accounting had not yet been released.

Cronos said reconciliation work with exchanges, bridges and other affected platforms remains underway following the restoration. Users do not need to take any action at this stage, while the block explorer, public RPC endpoints, indexers and subgraphs have returned to operation.

The post-mortem did not identify the attacker or detail how the network and Tectonic plan to address the $9.19 million that remains unrecovered.

CRO, the native token of the Cronos ecosystem, was trading around $0.058, up 0.62% over the past 24 hours.