Import incident
On 14 October 2026, two validation flaws allowed 39.82 million unauthorized ARRR to be created. After repairs, the network resumed on 19 October from the last valid block, excluding the affected branch.
-
Input-validation regression introduced
Import-shaped transactions bypass authorization during block connection.
GitHub · Regression commit -
Change ships in 6.0.0
GitHub · 6.0.0 release -
× Unauthorized mint
Historical block record#4176945Mined directly into this block ↗ 39.82 million ARRRCreated without backing · View mint transaction ↗Input checks were skipped. A crafted script bypassed the transparent-address rule.
Two transparent outputs2 × 19,910,937.51865961 ARRRSupply at the exploit block · ARRR Before198,984,937.38554749Exploit branch238,806,812.67286671+20.01% · Unauthorized mint plus 0.25 ARRR mining reward
-
Movement between shielded pools
Sapling≈19.91M ARRRIronwoodRecorded pool transfer · View transaction ↗
-
14 OctBefore 23:31 UTC
Ⅱ NonKYC freezes activity
The exchange reports suspicious deposits to the team.
NonKYC · reported figures
- ARRR deposited
- 561,444
- ARRR sold
- 516.0272
- USDT after fees
- ≈144.50
0.092% of reported deposits sold -
△ Incident publicly acknowledged
The team announces the incident through Discord, followed by its other social channels.
-
Ⅱ Notarizations paused
Last recorded receipt at #4177171. Exchanges and pools asked to halt by 23:48 UTC.
Last notarization receipt ↗ -
Import validation fixed
Block connection again verifies import authorization.
GitHub · Import validation repair -
Script recognition fixed
Crafted scripts can no longer impersonate an allowed destination.
GitHub · Script recognition repair -
Parsing safeguards added
Coin-import amounts and notarization script lengths receive bounds.
GitHub · Parser hardening -
Security release 6.0.10
The mandatory release includes both validation fixes and the parsing safeguards.
GitHub · 6.0.10 security release -
✓ Replacement chain begins
History through #4176944 is retained. The exploit and its descendant branch are excluded.
Retained ancestor#4176944✓ Replacement chain#4176945First replacement block ↗× Excluded branchLast retained block14 Oct4d 22h 5mRecovery intervalFirst replacement block19 OctExcluded from Watch’s timing charts.
↻ Payments from 14–19 October: verify confirmation on the replacement chain.
-
6.0.12
✓ Replacement checkpoints added
The consensus fixes reject the exploit; checkpoints pin the resumed branch.
GitHub · Recovery checkpoints -
6.0.14
✓ Recovery improvements
Header synchronization, stale-tip recovery and wallet reset improvements.
GitHub · 6.0.14 release notes -
Recovery
New tip
First block after rollback#4176945The crafted transaction violated the network’s issuance rules. After the exploits were patched, the corrected consensus rules rejected the counterfeit transaction, its block and every block built on it. Recovery restored the chain state and all balances exactly as recorded at #4176944, immediately before the exploit. The chain then continued with this first replacement block.
