Pirate Chain transaction-validation flaw exploited to mint about 39.8M ARRR (about 20% of supply)

Summary

Pirate Chain (ARRR) disclosed that an attacker exploited a transaction-validation flaw on 2026-10-14. The flaw let them create about 39.8 million ARRR, roughly 20% of supply at the time. Per the reporting below, the project attributes the flaw to two validation failures: a bypassed issuance check and incorrect interpretation of output scripts. The minted coins entered the Sapling shielded pool, so the project says their later movement cannot be fully traced.

Incident

• Victim: Pirate Chain (ARRR) network
• Date (UTC): 2026-10-14
• Amount: about 39.8M ARRR minted without authorization (per Pirate Chain, as reported by The Defiant, Crypto Briefing and KuCoin News). SlowMist's Hacked database records the loss as about $10.7M.
• Attack type: consensus/transaction-validation vulnerability (unauthorized minting)
• Crypto Briefing links the flaw to the Ironwood network upgrade activated on 2026-10-03. Other sources do not confirm this.

Impact

An attacker inflated the ARRR supply by about 20%. The project reports no evidence that its dPoW notarization keys or its shielded-transaction cryptography were compromised. dPoW notarization was suspended as a precaution. Crypto Briefing reports a proposal to revert the chain to its state as of 20:00 UTC on 2026-10-14, which would discard blocks produced after the exploit window. Treat this as a proposal until the project confirms it.

Recommended actions

• ARRR holders: do not move funds until the project confirms recovery is complete. Coins received after about 20:00 UTC on 2026-10-14 may be reversed if the proposed rollback goes ahead.
• Exchanges, custodians and mining pools: pause ARRR deposits, withdrawals and mining as the project requested. Credit deposits only after the post-recovery chain state is confirmed.
• Node operators: follow Pirate Chain's official channels for patched releases and rollback instructions, and verify any binary against the project's official repository.
• Beware of follow-on phishing: ignore unofficial "refund", "recovery" or "claim" links and DMs.

Indicators

None published. The minted coins went to the shielded pool, and no primary source has named attacker addresses.

Source & attribution

This 0xCERT advisory summarises Pirate Chain's disclosure (https://x.com/PirateChain/status/2110774266123767871) as recorded by SlowMist Hacked (https://hacked.slowmist.io/) and reported by The Defiant (https://thedefiant.io/news/hacks/pirate-chain-says-exploit-created-39-8-million-arrr) and Crypto Briefing (https://cryptobriefing.com/pirate-chain-exploit-arrr-rollback/). Details may change; refer to Pirate Chain's own channels for the authoritative record.