A security flaw in the Pirate Chain network allowed an unauthorized minting of approximately 39.8 million ARRR tokens. This amount represents roughly 20% of the total supply of the privacy-focused cryptocurrency. The vulnerability was identified on October 14, 2026, and is linked to two validation errors within the Ironwood network upgrade, which was implemented on October 3.
The illicitly minted tokens were transferred into the Sapling shielded pool, complicating efforts to trace their movement. In response, the development team has proposed a blockchain rollback to the network state as of 20:00 UTC on October 14. This measure aims to discard all blocks generated after the exploit occurred, requiring coordination from exchanges, miners, and node operators.
The project team confirmed that the network's notary keys and zk-SNARKs cryptography remain secure. To mitigate risks, users have been advised to refrain from moving funds, while exchanges and mining pools were requested to pause operations. The exchange NonKYC has already restricted deposits and blocked withdrawals associated with the exploit to prevent the conversion of the counterfeit tokens.
