Cardano network disrupted by ‘poisoned’ transaction attack

Cardano (ADA) price fell on Friday after the blockchain suffered an unexpected chain split due to a fraudulent delegated transaction that caused a software flaw. This caused problems for Cardano users and prompted public apologies from users who claimed they were the ones who caused the problem.

Intersect, the governance body of the Cardano ecosystem, said in an incident report that the divergence began when a fraudulent transaction passed validation on a new node version but was rejected by a node running older software.

“This exploits a bug in the underlying software library that was not trapped by the validation code,” Intersect wrote. “The execution of this transaction caused a fork in the blockchain, effectively splitting the network into two distinct chains: one containing the ‘poisoned’ transaction and a ‘healthy’ chain without it.”

Earlier in the day, Cardano co-founder Charles Hoskinson posted on X that this was a “planned attack from a disgruntled (stake pool operator) who was actively looking at ways to damage (Cardano developer Input/Output Global)’s brand and reputation.”

Hoskinson said all Cardano users were affected. Following the incident, the price of Cardano’s token ADA recently fell by more than 6%.

According to the incident report, this discrepancy caused operators to build blocks on different branches of the chain until patched node software was deployed. Developers and service providers have coordinated emergency responses, and operators have been urged to upgrade to return to the main chain.

Intersect said the wallet responsible for the fraudulent transactions had been identified, but Hoskinson said it would take several weeks to clear up the mess.

“Forensic analysis suggests a link to participants from the Incentivized Testnet (ITN) era,” Intersect wrote. “Relevant authorities, including the Federal Bureau of Investigation, are investigating this incident as it may be a cyber attack on a digital network.”

Hours after the incident, an X user posting under the name Homer J. said he was responsible for submitting the transaction that triggered the split.

“Dear Cardano, we are sorry. It was I who put the network at risk with my careless actions last night,” they wrote, stating that the attempt was a personal challenge to reproduce “illegal transactions” and relied on AI-generated instructions while blocking traffic on the server.

“I immediately felt terrible as I realized the magnitude of what I had caused. I know there is nothing I can do to make up for all the pain and stress I have caused over the past X hours,” they added. “It is difficult to quantify negligence on my behalf. I am truly sorry. I had no malicious intent.”

Homer wrote that he did not sell or short sell ADA, did not coordinate with anyone else, and did not act for financial gain. “I am ashamed of my negligence and take full responsibility for it and its subsequent consequences,” he said.

According to Intersect, no user funds were lost and most retail wallets were unaffected as they were running a Node component that securely processed fraudulent transactions.

Cardano’s outspoken co-founder Hoskinson claimed in a video message that users encountered the problem before it was fixed, but the network “didn’t go down.”

“It is important to note that the network did not go down; block generation continued on both chains during the incident, and at least some identical transactions appeared on both chains,” Intersect wrote. “However, to ensure the integrity of the ledger, exchanges and third-party providers have significantly suspended deposits and withdrawals as a precautionary measure.”