Stopping a blockchain doesn’t always recover stolen funds – What actually happened when 3 networks pulled the plug

Three blockchain networks stopped producing blocks within four days. Each blockchain halt used different emergency powers, and Cronos alone also replaced part of its canonical history.Cronos said validators halted the network by consensus after an exploit affected Tectonic, restored the chain to state from before the incident, and resumed production from block 90,896,189. The action replaced state as well as stopping production. Transactions and state changes that existed only after the chosen restore point no longer belonged to the restarted canonical chain.Ontology and ICON used different emergency levers. Ontology suspended block production before confirming malicious attack activity, and its Sept. 1 update said that activity did not compromise user assets. ICON first paused an affected contract, then halted a network that the ICON Foundation said it controlled during a migration period, after most of the affected ICX had already entered exchange custody.A blockchain halt reveals only the first layer of control. The deeper questions are who can order the stop, whether they can replace accepted state, and which losses remain when funds cross into another chain or a centralized cu...