Incidents

Consensus flaws create about 39.8 million unbacked ARRR

Cause: Two consensus flaws, an unchecked coin-import path and a misread time-locked script, let the coins be created and moved into the Sapling shielded pool.

Response: The team asked users not to move funds and exchanges and mining pools to pause, NonKYC restricted the associated account and notaries suspended notarisations; a proposed rollback to 20:00 UTC on 14 October gave way to a coordinated recovery, and mandatory release 6.0.10 of 18 October rejects blocks with the unbacked imports. The team said there was no sign that the zk-SNARK cryptography or the notary keys had been compromised.

Stolen funds reported moving through Privacy Cash

Cause: News reports, citing an on-chain analyst, said the proceeds of a theft of about $4 million from a trader's wallets were swapped into ETH, BNB and SOL and then moved through Privacy Cash and Chainflip. The theft was not from Privacy Cash.

Response: No statement from Privacy Cash about screening or blocking the funds was reported.

About $1.83 million in USDC leaves Payy's rollup contract

Cause: Not confirmed. Payy's GitHub advisory, published in June and recorded as CVE-2026-48100 on 28 September, describes a circuit flaw, fixed in version 1.3.0, that let a registered prover forge burn messages, but neither source links the flaw to the transfer.

Response: The Crypto Times reported that Payy had not commented.

Gateway Address flaw used to mint unauthorised ZANO and fUSD

Cause: A flaw in the Gateway Addresses added by Hard Fork 6 let an attacker create unauthorised ZANO and fUSD, in a first mint on 29 August and another on 25 September 2026, when Zano's tools raised the alarm.

Response: The chain was restarted from block 3,833,000 (release 2.2.3.600), removing about a month of history, including legitimate transactions; payments settled on other chains could not be reversed, and MEXC suspended ZANO and fUSD deposits and withdrawals at the team's request. The team said wallet spend keys were not compromised and affected balances would be recovered without minting new ZANO.

Consensus bug used to create 2,078 DCR

Cause: A consensus bug present since launch, an unhandled edge case between the regular and stake transaction trees, let an attacker double spend inputs between 12:20 UTC on 16 August and 19:44 UTC on 17 August 2026, after exploiting it on testnet on 14 August; it had been reported to the bug bounty on 12 August.

Response: Mandatory release 2.1.6, published at 15:25 UTC on 18 August, fixed it without a rollback; release 2.1.7 of 14 October 2026 added safeguards that halt a node on unexpected spends.

Malicious proposal drains ZKP on Panther's Base deployment

Cause: The attacker passed a proposal through the Base deployment's optimistic governance on Reality.eth, posting an uncontested answer with the required 0.5 ETH bond, and the proposal upgraded the ZKP token proxies on Base to a drainer.

Response: A Panther Foundation contributor said the Base deployment was not yet in production and no user funds were compromised.

Lapsed tornado.cash domain used for phishing

Cause: The project's original domain had lapsed and was reportedly registered by others, who used it for a copy of the interface built to capture deposit notes.

Response: TORN holders added a phishing warning to the community interface and in October 2026 voted to pay 1,000 TORN to two people for having the fraudulent site taken down.

Alpha V5 proving system flaw

Cause: The V5 Alpha proving system could be tricked into accepting a proof for a transaction the network should reject. Core contributors found it on 27 July 2026 through internal AI-assisted auditing.

Response: Disclosed on 7 August 2026, with application teams told to treat V5 funds and applications as exposed and to pause V5 deployments; circuit updates in V6, planned for later in 2026, are to stop the network accepting proofs tied to the affected proving system.

zkBob reopens in withdraw-only mode

Cause: zkBob deprecated the protocol after the double-spend flaw found in June 2026.

Response: The Polygon and Optimism pools restarted in withdraw-only mode, and users were urged to withdraw.

Hinkal's shielded pool drained through a double spend

Cause: BlockSec said the likely cause was a legacy note format that did not tie each note to a single nullifier, so one deposit could be spent several times; reports describe a proofless deposit followed by a series of transact calls.

Response: No post-mortem from Hinkal was found; BlockSec published its analysis on 9 July 2026.

Malicious proposal 67 rejected

Cause: Proposal 67's contract code had not been verified, and L2BEAT flagged it as malicious.

Response: TORN holders rejected it, with about 623,000 votes against and none in favour when voting closed on 30 June 2026.

Namada's shielded pool drained

Cause: Not published. DefiLlama classifies it as an unbacked cross-chain mint. The loss went unnoticed at first because the indexer kept showing balances while live RPC checks showed the pool empty.

Response: Namada confirmed the breach on 20 June 2026 and asked the attacker to return the funds.

Aztec's deprecated private rollup bridge drained

Cause: A validation flaw let the attacker withdraw assets while still passing on-chain verification. BlockSec described this and the Aztec Connect bug as circuit public input binding issues, and Rekt News attributed it to a flaw in the escape hatch circuit.

Response: Aztec Labs said it held no admin keys or control over the immutable contract of the payments product it deprecated in 2022, and the Aztec Foundation said the product had no links to the current network or the AZTEC token.

Second drain of the same Aztec Connect contract

Cause: The same boundary bypass, used by a second address from about 04:00 to 05:17 UTC on 15 June 2026 against positions left in the contract's DeFi bridges after the first drain.

Response: Rekt News did not confirm whether the same party controlled both addresses.

Deprecated Aztec Connect contract drained

Cause: A gap between the transactions the deprecated RollupProcessor contract settled and those covered by the proof's public inputs: the attacker set the number of real transactions to one in 14 processRollup calls, so a fake deposit was credited while a real withdrawal was settled.

Response: A second address drained about $88,000 more through the same flaw the next day (listed separately).

Axelar bridge contract on Secret drained through an infinite mint

Cause: A years-old minting flaw in a CW20-ICS20 contract tied to Secret Network's Axelar integration let the attacker mint wrapped tokens without backing.

Response: The bridge to Axelar was suspended, and the two teams disputed which of them was responsible for the contract.

Double-spend flaw found in a zkBob circuit

Cause: A critical double-spend vulnerability in one of zkBob's zero-knowledge circuits, found by its security team during a routine review.

Response: All pools were paused. After a circuit fix and a contract upgrade through the governance multisig on 5 July 2026, the pools reopened in withdraw-only mode (listed separately).

Court-ordered USDC freeze locks the cUSDC wrapper

Cause: A US federal court order in a class action over Overnight Finance, an unrelated protocol, led Circle to blacklist the Ethereum cUSDC wrapper at 01:08 UTC on 30 May 2026, because a disputed deposit made up more than 99% of the pool.

Response: Zama paused cUSDC, cUSDT and cWETH while it investigated, The Block reported. Circle removed the block at 18:58 UTC on 1 June 2026 after the court lifted the freeze, and Zama announced the next day that all systems were back to normal.

Orchard circuit soundness flaw

Cause: A soundness flaw in the Orchard circuit, found during an audit commissioned by Shielded Labs and reported on 29 May 2026, could have allowed theft and balance violations within Orchard.

Response: An emergency soft fork disabled Orchard transactions on 2 June 2026, and NU6.2 restored them with a corrected circuit on 3 June.

Legacy Arbitrum dark pool re-initialised and drained

Cause: The V1 dark pool on Arbitrum had been deployed without an explicit owner, and a faulty migration in an April 2025 update left its version counter out of sync, so anyone could re-initialise the contract.

Response: Renegade offered a 10% bounty, and the attacker returned about $190,000 within 45 minutes. Renegade said about 7% of its trading went through the affected pool, other deployments were unaffected and affected users would be compensated.

Several node vulnerabilities disclosed

Cause: Several vulnerabilities in the zcashd and Zebra node software, including one that could have disabled turnstile accounting.

Response: Patched before disclosure on 17 April 2026; Zodl said none could by themselves have inflated the ZEC supply.

zcashd skipped Sprout proof verification

Cause: A zcashd bug made nodes skip Sprout proof verification for new blocks, so invalid transactions from a miner could have drained the deprecated Sprout pool. Zebra nodes were not affected.

Response: Reported by the security researcher Alex Sol on 23 March 2026, fixed in zcashd 6.12.0 and disclosed on 31 March; the turnstile ruled out supply inflation.

SDK generated keys with too little entropy

Cause: The version 1 SDK converted key material to a standard JavaScript number, which left newly generated account keys with less than the intended 256 bits of entropy.

Response: 0xbow fixed the conversion on 18 March 2026 and released a migration flow on 19 March so that existing users could move their accounts to stronger keys.

FOOM Cash drained through a misconfigured verifier

Cause: The zero-knowledge lottery's Groth16 verifier kept default setup values, which let the attacker forge proofs.

Response: A white-hat rescue returned $1.84 million, Rekt News reported.

Veil Cash loses 2.9 ETH to a verifier flaw

Cause: The same kind of flaw that FOOM Cash suffered days later: a Groth16 verifier that kept default setup values, which let forged proofs pass.

Response: The ETH was later returned, Rekt News reported.

Access-control contract paused for 84 minutes

Cause: Not confirmed: the contract that records which addresses may use or decrypt each encrypted value was paused at 14:17 UTC by an address authorised to pause it, and Zama's reason has not been confirmed.

Response: Unpaused at 15:41 UTC through the execution of a governance proposal.

Forged enclave attestations shown on testnet

Cause: WireTap and Battering RAM, physical attacks on Intel SGX servers that need special equipment, let researchers forge attestations; on Secret Network's testnet they created a forged enclave that accessed confidential data. The researchers said they extracted nothing from mainnet.

Response: Version 1.22 suspended new nodes, set up an allowlist of trusted nodes and rotated the network seed as a precaution; version 1.23 was to admit new nodes through governance.

18-block chain reorganisation

Cause: An 18-block reorganisation starting at height 3,499,659; The Block reported that responsibility had not been established.

Response: Temporary rolling DNS checkpoints, which the Monero Research Lab had urged developers to consider, remained an open proposal with no linked code in October 2026.

Wallet sent outgoing transaction IDs to remote nodes

Cause: Wallet versions 0.12.0.0 to 0.18.4.1 sent the IDs of a wallet's outgoing transactions to the connected node whenever the wallet was loaded, even an untrusted remote node, whose operator could use them to infer later spends.

Response: Version 0.18.4.2, released the same day as the disclosure, fixed the bug.

Qubic claims a majority of Monero's hashrate

Cause: The Qubic mining pool said it had reached 51% of the hashrate, and The Block reported a six-block-deep reorganisation; a Serai developer called it a reorganisation attack rather than a full 51% attack. A December 2025 preprint found more orphaned blocks and deeper reorganisations during the campaign but no sustained majority control.

Response: Kraken paused XMR deposits as a precaution, according to Cointelegraph. Temporary rolling DNS checkpoints were proposed on GitHub on 31 August 2025.

Ban list recommended against suspected spy nodes

Cause: A spying party ran a few nodes behind many IP addresses, which weakens the privacy that Dandelion++ gives transaction relay; many of the addresses sit in a few subnets linked to the LinkingLion spying seen on Bitcoin.

Response: The Monero Research Lab recommended that node operators enable a voluntary ban list of the suspected IP addresses, compiled by a Cuprate developer, rather than blocking them by default.

Inflation bug in Aleo's output commitments

Cause: The output commitment scheme did not include an output's subtype in the hash, so an attacker could swap a Future output for a Private one with the same hash and the on-chain finalize logic would never run.

Response: Reported by zkSecurity on 24 November 2024 and confirmed by Aleo the same day; the fix was merged on 3 December and rolled out to all validators on 4 December 2024.

Replaced installer, coordinator outages and a fee exploit

Cause: Over 9 and 10 July 2024 an account with write access to the GitHub repository was compromised and the Windows installer of version 2.0.8.1 replaced with a different file; several free coordinators, mainly the busiest, were repeatedly taken down by denial-of-service attacks; and a coordinator used a fee weakness to charge users the maximum fee.

Response: A monitoring bot spotted the installer's changed hash; the file was removed and access rights revoked, and version 2.1.0.0 let clients cap the fees and set the minimum round size they accept.

zkSNACKs ends the Wasabi coinjoin coordinator

Cause: ForkLog said the decision followed increasing law enforcement pressure on mixers.

Response: The coordination service stopped from 1 June 2024, which also affected Trezor Suite and BTCPay Server users.

Nocturne closes

Cause: The team announced the company's closure about five months after discontinuing version 1 of the protocol; GNcrypto reported no reason.

Response: Users could withdraw through the Nocturne app until the end of June 2024, after which self-service withdrawal tools were to be published on GitHub.

Samourai Wallet servers seized and founders charged

Cause: US prosecutors charged the founders with money laundering and unlicensed money transmitting conspiracies, alleging more than $2 billion in unlawful transactions.

Response: Samourai's servers and domain were seized with Icelandic authorities. The court cases that followed are on the Timeline.

Suspected black marble flooding

Cause: Transaction volume rose sharply from 4 March 2024. A Monero Research Lab researcher's preliminary analysis treated it as a suspected flood of one party's own transactions, which would fill other users' rings with decoys that party can rule out.

Response: The analysis set out countermeasures, including larger ring sizes.

Elusiv announces its sunset

Cause: The source cited gives no reason.

Response: QuickNode's guide to the Solana privacy protocol says it announced the sunset on 29 February 2024 and keeps the guide for historic educational purposes only.

Malicious interface code leaked deposit notes

Cause: An interface version pinned through a governance proposal contained hidden JavaScript that sent users' deposit notes to an outside server, exposing deposits made through public IPFS gateways from early January 2024.

Response: The leak was disclosed in late February 2024, and a governance proposal executed in March 2024 replaced that version.

Community Crowdfunding System wallet drained

Cause: Not found: the Core Team said it had not identified the cause of the breach.

Response: The Core Team disclosed the theft on 4 November 2023 and covered the loss from the General Fund.

Chain halts during the v19 activation

Cause: Dash's chief technology officer said there was a problem during the activation of Dash Core v19, and the chain stopped producing blocks at block 1,874,879.

Response: The team said it had what it needed to resolve the issue; the source cited gives no time for the restart.

Attacker takes over Tornado Cash governance

Cause: Governance proposal 20 contained hidden code that granted the attacker 1.2 million votes and control of the DAO. The immutable pools could not be drained.

Response: On 26 May 2023 TORN holders passed the attacker's own proposal 21 handing control back, with about 517,000 votes in favour and none against.

Aztec Connect sunset announced

Cause: Aztec Labs decided to wind down the Aztec Connect privacy rollup.

Response: Deposits were disabled in March 2023 (on 21 March, according to its documentation) and withdrawals were processed for a year, to 31 March 2024. The rollup's code is open source, so anyone can still publish blocks.

FBI says North Korean hackers moved stolen ether through Railgun

Cause: The FBI said on 23 January 2023 that North Korea's Lazarus Group was behind the June 2022 theft from Harmony's Horizon bridge and had used Railgun on 13 January 2023 to launder more than $60 million of the stolen ether.

Response: In April 2024 Railgun called this a false allegation and said its Private Proofs of Innocence system blocks such actors.

Consensus seed extracted through Intel SGX flaws

Cause: The SGX.Fail researchers used Intel SGX flaws made public on 9 August 2022 to obtain Secret Network's consensus seed, a master decryption key for its private transactions. They began their disclosure on 1 October 2022.

Response: Registration of new nodes was frozen and, from 2 November 2022, reopened only to hardware that was not vulnerable.

US Treasury sanctions Tornado Cash

Cause: OFAC said Tornado Cash had been used to launder more than $7 billion since its creation in 2019, including over $455 million stolen by North Korea's Lazarus Group.

Response: OFAC redesignated it on 8 November 2022 with North Korea-related grounds added, and removed it from the sanctions list on 21 March 2025.

Spam transactions stall light wallets

Cause: From June 2022, shortly after NU5, transactions with very large numbers of shielded outputs swelled the chain and stopped several light wallets from syncing.

Response: The ZIP 317 fee change, shipped in zcashd 5.5.0 in April 2023, throttled the spam, and the Electric Coin Company ended its emergency response on 1 November 2023.

xAsset minting exploits

Cause: Flaws in Haven Protocol's private xAsset code let attackers mint assets without backing.

Response: The team halted exchange deposits, paused conversions and proposed a chain rollback.

Lelantus switched off after suspicious transactions

Cause: Irregular behaviour and suspicious transactions in Lelantus, whose cause the team looked for with Trail of Bits, the cryptographer Sarang Noether and a black hat.

Response: The team switched Lelantus off with its emergency switch; it was re-enabled after a hard fork at block 365,544 with Firo v14.6.0, announced on 26 April 2021.

Reorganisation of more than 560,000 blocks

Cause: Coin Metrics staff reported a reorganisation of more than 560,000 blocks that erased about 200 days of transaction history. The Verge team said malicious nodes had sent transaction spam that failed to cause a fork and that there was no 51% attack.

Response: The team said its explorer's database had been corrupted and was resyncing, and that holders' coins were safe.

51% attack rolls back more than 300 blocks

Cause: An attacker with a majority of the hashrate mined a private chain that replaced more than 300 blocks, reversing deposits made to exchanges.

Response: Firo locked the attacker's proceeds, held in one address with 867,652 FIRO, set a maximum reorganisation depth of five blocks, briefly disabled Lelantus and brought forward ChainLocks to block 341100 (about 28 January 2021); it put the handling of the locked funds to a community vote.

Sybil attack on the peer-to-peer network

Cause: Malicious nodes injected themselves into honest nodes' peer lists, exploiting a bug that made them more likely to be chosen, dropped transactions and recorded IP addresses to try to link them to transactions. Decrypt reported on 10 November 2020 that it had been running for about ten days.

Response: The nodes were blacklisted. Dandelion++, in place since April 2020, and broadcasting over Tor limited what they could learn.

Download site served a malicious wallet build

Cause: getmonero.org briefly served a malicious build of the command-line wallet.

Response: The project moved downloads to another source and told anyone who downloaded the wallet between 02:30 and 16:30 UTC to check file hashes and not run mismatching files.

MiMC circuit flaw allowed forged deposit proofs

Cause: A flaw in the circomlib MiMC hash circuit used by the pools would have let anyone forge a proof of deposit and withdraw funds.

Response: The team used the flaw to drain the mixer, patched the circuits and moved users' funds to new contracts, as described in its post 'Tornado.cash got hacked. By us.'

Transaction spikes crash masternodes

Cause: Two large spikes in transactions, from either a malicious actor or a developer running a stress test; masternodes crashed or cut each other off, some pools mined near-empty blocks, some payments were delayed and average fees rose from $0.01 to $0.18.

Response: Dash Core 0.14.0.3 added protections against spam attacks and stress tests.

Zerocoin flaw used to create coins on Zcoin, now Firo

Cause: A fundamental flaw in the cryptography of the Zerocoin protocol.

Response: Zcoin moved from Zerocoin to its own Sigma protocol later in 2019, according to its review of the year.

Burning bug in the Monero wallet

Cause: The wallet gave no warning on receiving a burnt output. An attacker could reuse one transaction key so that many payments landed on one stealth address, of which only one could ever be spent, leaving an exchange with unspendable deposits at the cost of network fees.

Response: A private patch (pull request 4438) was applied on top of the 0.12.3.0 release branch for affected organisations before the public post-mortem of 25 September 2018.

Second timestamp attack mints 35 million XVG

Cause: The attacker repeated the timestamp attack, this time across two of Verge's mining algorithms, Scrypt and lyra2re.

Response: The sources cited describe no fix.

Timestamp attack mines blocks about once a second

Cause: The attacker exploited a difficulty-retargeting bug by mining blocks with spoofed timestamps, producing a block about once a second for some three hours on the Scrypt algorithm.

Response: The team called it a small hash attack and hard-forked to undo the exploited blocks, which left the network unable to sync until it was re-synced; Security Affairs said the underlying issue was not fully resolved.

Counterfeiting flaw in the Sprout proving system

Cause: A flaw in the proving system of the original Sprout pool (CVE-2019-7167) could have let an attacker create fake ZEC without being detected. It did not affect user privacy.

Response: Found by an Electric Coin Company cryptographer on 1 March 2018 and kept private, closed by the Sapling upgrade of 28 October 2018, and disclosed on 5 February 2019.

Key image flaw in CryptoNote patched

Cause: A flaw in CryptoNote key images could have allowed unlimited coin creation, undetectable to an observer.

Response: Patched without public disclosure on 21 February 2017 and disclosed on 17 May 2017.

Zerocoin code typo lets an attacker reuse spend proofs on Zcoin, now Firo

Cause: One extra character in Zcoin's Zerocoin code let an attacker reuse valid proofs to make extra spends; the team said the bug was not a weakness in the cryptography and had not compromised anonymity.

Response: Zcoin announced the bug and its estimate of the coins created, according to The Hacker News.