Cardano network disrupted by ‘poisoned’ transaction attack

The price of Cardano (ADA) fell on Friday after the blockchain suffered an unexpected chain fork, caused by a mishandled delegation transaction that caused a software bug. That caused problems for Cardano users and led to a public apology from the user who claimed they caused it.

Intersect, the governing body of the Cardano ecosystem, said in an incident report that the divergence started when the malformed transaction passed validation on newer node versions, but nodes running older software rejected it.

“This exploited a bug in an underlying software library that was not captured by validation code,” Intersect wrote. “The execution of this transaction caused a divergence in the blockchain, effectively splitting the network into two separate chains: one with the ‘poisoned’ transaction and a ‘healthy’ chain without it.”

Earlier that day, Cardano co-founder Charles Hoskinson posted on X that it was a “premeditated attack from a disgruntled [stake pool operator]’ who ‘was actively looking for ways to damage the brand and reputation of [Cardano developer Input/Output Global].”

According to Hoskinson, all Cardano users were affected. The price of Cardano’s token ADA recently fell by more than 6% as a result of the incident.

According to the incident report, the mismatch caused operators to build blocks on different branches of the chain until patched node software was deployed. Developers and service providers coordinated emergency response, and operators were urged to upgrade to rejoin the main chain.

Intersect said the wallet responsible for the misformatted transaction has been identified, while Hoskinson said it will take weeks to clean up the mess.

“Forensic analysis suggests links to an Incentivized Testnet (ITN) era participant,” Intersect wrote. “As this incident constitutes a potential cyber-attack on a digital network, relevant authorities, including the Federal Bureau of Investigation, are being called in to investigate.”

Hours after the incident, an X user going by the name Homer J. said he was responsible for submitting the transaction that caused the split.

“Sorry Cardano people, it was me who compromised the network last night with my careless action,” they wrote, describing the attempt as a personal challenge to reproduce the “bad transaction” and saying he relied on AI-generated instructions while blocking traffic on their server.

“I felt terrible as soon as I realized the extent of the damage I caused. I know there’s nothing I can do to make up for all the pain and stress I’ve caused over the past X hours,” she added. “Difficult to quantify the negligence on my behalf. I’m sorry, I really am. I had no malicious intent.”

Homer wrote that he did not sell or short ADA, did not coordinate with anyone else and did not trade for financial gain. “I am ashamed of my carelessness and take full responsibility for it and the consequences that will follow,” he said.

According to Intersect, no user funds were lost and most retail wallets were unaffected because they were running node components that safely handled the mis-formed transaction.

Hoskinson, the outspoken co-founder of Cardano, claimed in a video message that the network “didn’t go down,” although users did experience issues before the issue was resolved.

“It is important to note that the network did not freeze. Block production continued on both chains throughout the incident, and at least some identical transactions appeared on both chains,” Intersect wrote. “However, to ensure the integrity of the ledger, exchanges and third-party providers have largely halted deposits and withdrawals as a precaution.”