Pirate Chain Says Exploit Created 39.8 Million ARRR

Pirate Chain said a transaction-validation exploit allowed the unauthorized creation of approximately 39.8 million ARRR, expanding the cryptocurrency's supply by roughly 20%, and asked users to stop moving funds.

The privacy-focused blockchain said in an Oct. 15 update that the vulnerability was discovered on Oct. 14. The newly minted coins were immediately transferred into the Sapling shielded pool. Their full subsequent movement cannot be traced because of the nature of shielded transactions, the project said.

Pirate Chain said crypto exchange NonKYC identified suspicious deposits, restricted the associated account and prevented withdrawals. The team said it believes activity related to the unauthorized issuance was otherwise primarily confined to onchain transactions.

Operators of delayed Proof-of-Work, or dPoW, agreed to temporarily suspend notarizations as a voluntary precaution, according to the update. The system notarizes Pirate Chain transactions onto Komodo Classic and then Litecoin to help protect against double-spending attacks.

Exchanges and mining pools have been asked to voluntarily pause operations while a recovery plan is developed. Pirate Chain said the blockchain itself remains operational, but asked all users to temporarily refrain from sending or moving funds.

Pirate Chain attributed the exploit to two validation failures: a bypassed issuance check and incorrect interpretation of output scripts. It said evidence did not indicate any compromise of notary keys or the cryptography underlying its shielded transactions.

Recovery Plan Still in Development

An initial notice linked the issue to the transparent supply-accounting layer associated with Ironwood and said developers would roll the chain back to Oct. 14.

The later update stressed that the network's decentralized structure means the team cannot freeze it or unilaterally roll back its blockchain history. It said a recovery plan was still being developed.

The project said it was investigating the event and developing solutions with other communities. Further technical details and recovery instructions will be provided in a forthcoming post-mortem.