A blockchain rollback is the one thing the technology is sold as being unable to do, and in the ten days from 30 August to 9 September 2026 two networks did it. On 30 August the validators of Cronos, the Layer 1 associated with Crypto.com, halted their chain at block 90,907,150, restored its state to block 90,896,188 and resumed from 90,896,189, discarding 10,961 blocks by the network’s own count and one hour and 54 minutes of settled history to unwind a lending exploit the report sizes at $120.4 million borrowed (first-week estimates had run from $66 million to $75 million), according to the network’s own incident report as rendered by The Crypto Times. On 9 September the functionaries of Blockstream’s Liquid sidechain, halted since Monday morning after a bug let someone create 4,000 unbacked L-BTC and peg out 3,996 real bitcoin, resumed block production from block 4,050,335 — the block before the one their incident report names as the exploit block — and re-filled 897 heights that had already been filled once. Both networks announced a “restart” and a “replay.” Neither told holders how to verify what had been kept and what had been thrown away. This guide is the checklist, written so that you can run it on a phone with a public block explorer, and it ends with both September cases scored.
The guide sits in the Reading Room’s security cluster with #28, #43, #44 and #45. It assumes you know what a block and a transaction are and nothing else.
1. What a rollback is, and four things it is not
A rollback, rewind or reorganisation is when the network that produces a chain stops extending its most recent block, goes back to an earlier one, and builds a new sequence of blocks from there. Every block after the chosen point is discarded — “orphaned” in Bitcoin’s vocabulary — and every transaction that lived only in those blocks ceases to exist unless someone re-broadcasts it into the new chain. The chain does not remember the discarded blocks; explorers stop serving them; balances revert to what they were at the chosen block and then move forward again as the new blocks are built. It is a different thing from four events it is often confused with. A pause or halt stops new blocks but keeps every old one: Liquid from Monday 04:49 UTC to Wednesday 21:05 UTC was paused, not rolled back, and its rollback happened at the moment it restarted. A freeze is an application- or asset-level action — a stablecoin issuer blacklisting an address, an exchange suspending withdrawals — that leaves the chain untouched. A fork in the software sense changes the rules going forward and may or may not change history: Ethereum’s 2016 DAO fork moved coins by rule change without discarding a single block. And a revert in ordinary usage often means one transaction failing, which is a transaction-level event with no bearing on the chain.
The distinction that matters for you is the second one. A paused chain is a chain on which your last confirmed transaction still stands. A rolled-back chain is a chain on which it may not. The five checks below are how you find out which one you are looking at.
2. Who can do one, and how many signatures it takes
On a proof-of-work chain like Bitcoin, nobody decides a reorganisation; miners discover one when a competing chain accumulates more work, and the deepest reorganisations in Bitcoin’s history were emergencies of exactly this kind — the August 2010 value-overflow bug, when a transaction created 184 billion bitcoin and the network abandoned the chain containing it within hours, and the March 2013 database fork, when miners running the newer software voluntarily fell back to the older chain. Both were resolved by miners choosing which chain to extend, and both are the reason Bitcoin developers, Adam Back among them in the 2019 conversation embedded above, treat deliberate reorganisations as a thing to be designed out. Neither has happened since; a one-block reorganisation on Bitcoin is now rare enough to be reported.
On a federated or proof-of-stake chain the answer is a number. Liquid’s blocks are signed by 11 of 15 functionaries, so a Liquid rollback is a decision by at least eleven organisations to sign a new block 4,050,336 on top of the old 4,050,335 and to refuse the old one. Cronos’s report describes “node operators” agreeing, after “several rounds of coordination and a patched validator build,” to restore state to block 90,896,188. In each case the rollback is not a bug or an attack; it is the security model working as designed, in the hands of the people the model trusts. That is neither a criticism nor an endorsement. It is the thing to know before you hold an asset on such a chain: the set of parties that can sign blocks is the set of parties that can unsign them, and their number is published. Bitcoin’s own chain was not rolled back by either incident; the 3,996 BTC that left Liquid are as final on Bitcoin as any other transaction, which is check five below.
3. The five checks
Check one: the timestamp seam. Open the explorer at the height where the restart was announced and look at the block immediately before it. On a healthy chain consecutive blocks are minutes apart. On a rolled-back chain there is a seam: the last kept block carries the old date and the first new block carries the restart date, and nothing in between. On Liquid, block 4,050,335 is stamped 13:52:10 UTC on 6 September and block 4,050,336 is stamped 21:05:10 UTC on 9 September: three days, seven hours and thirteen minutes between neighbours on a one-minute chain. Cronos’s report gives the same seam in words: halt at block 90,907,150 at 14:32:47 UTC, restart from 90,896,189 at 23:49:01 UTC the same day. The seam tells you the exact block that was chosen as the last good one. Everything you did after that block’s timestamp was, at least initially, discarded.
Check two: the height re-use. This is the one that requires you to have looked before. If you, or anyone, recorded a block at a given height before the restart, compare it to the block at that height now. A block’s timestamp and hash are part of its identity; if either differs, it is a different block, and the chain has been reorganised rather than merely resumed. This desk recorded Liquid’s tip as 4,051,232 on Thursday morning, a height that NFTevening had stamped 04:49 UTC on Monday; on Friday morning the block at 4,051,232 is stamped 12:19:10 UTC on Thursday. That single comparison is the proof of rollback; the seam alone could in principle be a pause. If you did not record anything, secondary sources often did — news reports quote heights and times, and the discrepancy between a reported time and the explorer’s current time at the same height is the same evidence. Cronos’s report says outright that “discarded-fork blocks no longer resolve on public explorers” and points researchers to archive snapshots, which is the honest way to publish a rollback.
Check three: the replay burst. A restarted chain has to decide what to do with the transactions from the discarded window. If it re-broadcasts the ones it considers valid, the first new blocks will be unusually full and then the chain will go quiet. Liquid’s first block after the seam carried 4 transactions, its second carried 329, its third 83, its fourth 40; then one-transaction (coinbase-only) blocks for most of the next hundred, with 490 non-coinbase transactions across eight blocks in the first hour and 46 minutes. That shape is a replay. Read it for two things: how large the replay was relative to the discarded window (Liquid ran roughly fifteen hours of blocks after the exploit before halting; 490 transactions is a fraction of what fifteen hours normally carries, which tells you the replay was selective), and whether your own transaction is among them, which is check four. Cronos did the opposite — its report says every transaction in the 114-minute window was reversed “whether or not it touched the exploit” — and a chain that replays nothing shows no burst at all.
Check four: the discarded window, and your place in it. Subtract the seam block’s timestamp from the halt block’s. That interval is the period in which anything you did may not have happened. For Cronos it is 1 hour 54 minutes and the network says so; for Liquid it is roughly 13:53 UTC on 6 September to 04:49 UTC on 7 September, about fifteen hours, and the network has not, as of Friday morning, published the count of transactions kept versus dropped. Then check your own history: find the transaction you made in the window on the current chain. If it is there with a new block height and a new timestamp, it was replayed. If it is gone, it was discarded, and the coins it moved are back where they were at the seam block. For an L-BTC holder who did nothing between Sunday lunchtime and Monday morning, the rollback changes nothing. For a trader who swapped on SideSwap on Sunday evening, it may have unwound the swap. For an exchange that credited a deposit confirmed at 02:00 UTC on Monday, it may have credited a deposit that no longer exists — which is precisely the reconciliation problem Cronos’s report says exchanges and bridges were still working through a week later.
Check five: the other chain. A rollback only unwinds its own ledger. Anything that crossed to a different chain before the halt is beyond it. On Liquid, the 3,996 BTC that the federation paid out on the Bitcoin main chain at 14:28 UTC on Sunday are Bitcoin transactions; rolling Liquid back to 13:52 UTC removes the unbacked L-BTC from Liquid’s history but does not, and cannot, bring the bitcoin back — which is why the 598.5 BTC still held by the whitehats is a Bitcoin-chain negotiation and not a Liquid-chain fix. On Cronos, the report says $9.19 million had been bridged out before the halt and “has not been recovered and is beyond the restoration’s reach.” The rule is simple: a rollback is a remedy for what is still on the chain. Read the bridge and peg addresses on the destination chain to see what is not.
4. What it means for the thing you hold
Three questions, in order. First, is my balance the same as before the window? On a rolled-back chain your balance is what it was at the seam block plus whatever was replayed. Check it against a record from before the halt, not against the explorer’s current view, which is by construction the post-rollback view. Second, is the asset I hold still backed? A rollback can remove unbacked units from the ledger — that is what Liquid’s did to the 4,000 L-BTC created by the bug — but it cannot restore reserves that left. Liquid’s peg address held 3,601.47 BTC on Friday against a pre-exploit reserve the federation puts at 4,205; the rollback did not change that ratio and Adam Back’s statement that the peg “will be covered” is a promise about the future, not a description of the ledger. Third, can I exit? A restarted chain and a reopened exit are different milestones; Liquid’s status on Thursday said peg-outs remain suspended while “restoring the BTC/LBTC reserve is in progress,” and SideSwap said its swaps stay paused until it is satisfied. Until the exit is open, a token on a rolled-back chain is a claim on the operators’ next decision, which is the same thing it was during the pause.
5. The scorecard: Liquid, 9 September, and Cronos, 30 August
Liquid. Seam: visible and exact, 4,050,335 (13:52:10 UTC 6 Sep) to 4,050,336 (21:05:10 UTC 9 Sep). Height re-use: confirmed by this desk’s own Thursday record; 897 heights replaced. Replay burst: visible, 490 non-coinbase transactions in the first 106 minutes, then quiet. Discarded window: about fifteen hours; count of kept versus dropped transactions not published. Other chain: 3,996 BTC left on Bitcoin; 3,400 returned; 598.5 outstanding; the rollback touched none of it. Disclosure: the federation announced a three-stage plan including “replay transactions verified as valid” and a status saying blocks had resumed “without transactions” — the second statement is contradicted by the 329-transaction block that preceded it by fifteen hours, and neither statement said that the chain had been rewound to before the exploit or by how many blocks. A holder who read only the announcements would not know a rollback had occurred. That is the guide’s central finding and the reason it exists.
Cronos. Seam: given in the report to the second, 90,896,188 to 90,896,189, 23:49:01 UTC. Height re-use: stated — discarded blocks “no longer resolve on public explorers,” archive snapshots offered. Replay: none; every transaction in the window reversed, stated plainly, with the number of blocks (10,961) and the duration (1 hour 54 minutes). Discarded window: quantified. Other chain: $9.19 million bridged out, quantified, described as beyond reach. The report conceded a communication failure and did not quantify how many unrelated transactions were reversed, but nine days after the event it published the block heights, the duration and the money trail. On the five checks Cronos disclosed four of five itself and Liquid disclosed none of five; a reader had to run them. The desk notes the irony without leaning on it: the Bitcoin sidechain built by people who spent a decade arguing that reorganisations are the thing to design out is the one whose rollback had to be discovered from the chain.
6. A marker, and the standing rule
The desk sets one marker from this guide. AC1: by Wednesday 30 September, Blockstream or the Liquid Federation publishes the number of transactions replayed and the number discarded in the 9 September restart, or an equivalent account of the rewound window. The standing rule for readers is shorter. When a chain you hold assets on announces a “restart,” open the explorer, find the seam, and compare one height you knew before to the same height now. If they differ, everything after the seam is a question until you have checked your own transactions against the new chain. The announcement will tell you the chain is back. Only the chain will tell you which chain.
Every guide in the series is indexed in the Reading Room. Today’s reporting on the restart itself is here.
Sources: blockstream.info/liquid API for every Liquid block height, hash, timestamp and transaction count, pulled 06:10–06:40 UTC 11 September; this desk’s 10 September edition for the Thursday tip height; the Liquid Federation’s incident report and resumption status and SideSwap’s statement as rendered by The Crypto Times and Bitcoin.com News; the Cronos Network incident report of 8 September as rendered by The Crypto Times; mempool.space for the Bitcoin-chain figures. Historical Bitcoin events (August 2010, March 2013) are described from the public record and no figure from them is used in the scorecard.
Method: prices, funding, open interest, basis and on-chain figures in this article are pulled directly by Bitcoin Mastery at the timestamp stated — Bitstamp BTC/USD daily candles for closes, Binance BTCUSDT spot and USDT-margined perpetual for intraday, open interest, funding and account ratios, Binance COIN-M quarterly contracts for basis, mempool.space for difficulty, hashrate, pool shares, fees and individual Bitcoin transactions, blockstream.info’s Liquid API for sidechain block heights, hashes, timestamps and transaction counts, alternative.me for the Fear & Greed series, Farside Investors’ table for ETF flows and US Treasury CMT par yields for rates. Where a third-party figure is cited we name the source and its date; where two sources disagree we print both. Every streak or extreme figure is published with the first date of its series in the same sentence.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Cryptocurrencies are volatile and you can lose money. Nothing here is a recommendation to buy or sell any security, digital asset or exchange-traded fund, including MSTR, L-BTC or HYPE. Do your own research and consult a licensed financial advisor before making investment decisions.