Summary
Between 2026-08-28 and 2026-08-31, the network's block-reward accounting system was exploited to credit validator rewards at an accelerated rate. While this pulled block rewards scheduled for future emission forward, it did not create any CORE beyond the protocol’s limits; the 2.1B maximum supply was never violated. Approximately 255M CORE of rewards were issued ahead of schedule.
The bulk of the accelerated CORE (≈186M) was removed from supply, permanently reversing that portion. A further ≈69M had been moved elsewhere by the malicious actors before the upgrade, beyond the reach of the on-chain reconciliation. Core Foundation is working with the relevant partners to recover those funds, and closely with law enforcement in the relevant countries to identify and apprehend those responsible.
The issue was contained and resolved through a coordinated network upgrade, CoreRewardFix, which activated on the Core mainnet on 2026-09-03 at 13:00 UTC. The upgrade (1) permanently closed the vulnerability, and (2) performed a one-time, on-chain reconciliation that removed the accelerated CORE from circulation while preserving the legitimate earnings of every honest validator.
The upgrade activated cleanly with no network downtime. All effects were verified on-chain.
No user or staker funds were lost. The exploit affected only reward accounting; delegated stake and user balances were never at risk.
Impact
The exploit pulled forward rewards from the network’s existing reward pool; no CORE was created beyond the protocol’s fixed supply schedule, and the maximum-supply cap was never violated. In total, approximately 255M CORE of accelerated rewards were issued ahead of schedule. Their disposition:
Accelerated CORE
Amount
Status
Total accelerated rewards received
≈255M CORE
Pulled forward from the reward pool
Removed from supply (burned)
≈186M CORE
✅ Complete
Moved out of reach before the upgrade
≈69M CORE
Recovery in progress
Other impact:
Network downtime
None
- upgrade applied in-band
User / staker funds affected
None
Legitimate validator earnings
Preserved
(reconciliation removed only the accelerated surplus)
Staking rewards
Temporarily paused during remediation;
restored
after the upgrade
The removed CORE (≈186M) was not transferred to any address. Balances were reduced directly in the state database, permanently burned, thereby lowering total supply. Of the ≈69M that had been moved before the upgrade and was therefore beyond the reach of the on-chain reconciliation, the majority was dispersed by the attacker across a large number of external wallets; recovery of those funds is being pursued through the appropriate channels. We are working closely with law enforcement in the relevant countries to identify and apprehend the malicious actors.
Root Cause
The network credits block rewards to validators through a privileged, protocol-internal path. A flaw in that path meant that, under a specific and unusual account configuration, the reward crediting for a block could be repeated more than intended, releasing block rewards scheduled for future emission ahead of time and raising the current supply faster than intended.
The surplus was distributed through the normal reward-settlement process, which is why it appeared both in attacker-controlled addresses and, unintentionally, in the reward addresses of honest validators who simply received an inflated payout they did not cause.
In line with responsible-disclosure practice, we are not publishing a step-by-step reproduction. The corrective changes are public in the client release, and the defenses below are live on mainnet.
Timeline (UTC)
Date
Event
2026-08-28 - 08-31
Accelerated rewards credited across three daily settlement rounds (last: 08-31 00:00).
2026-08-31 06:17
Inflation halted on-chain via governance. A reward parameter was changed to stop further accelerated issuance.
2026-09-01 00:09
Accumulated reward captured at the turn-round settlement and secured by Core Foundation.
2026-09-02
Fix developed, rehearsed on a public testnet, and released.
2026-09-03 13:00
CoreRewardFix activates on mainnet
(block 38,376,795). Vulnerability closed, supply reconciled, network continues without interruption.
Resolution: the CoreRewardFix upgrade
Delivered in client v1.0.26, the upgrade activates a set of defenses at the fork time and performs a one-time balance reconciliation:
Defenses (permanent):
- A per-block guard on the reward-crediting path, ensuring a block’s reward can be credited at most once.
- Rejection of blocks whose coinbase account carries an EIP-7702 delegation, removing the account configuration that enabled the abuse.
- Rejection of unexpected zero-gas transactions, as an additional backstop (legitimate protocol system transactions remain unaffected).
Supply reconciliation (one-time, at the upgrade block):
- Attacker-controlled pools were set to zero.
- Affected validator reward addresses were reduced to a fair-earnings floor defined as each validator’s pre-incident balance plus three rounds of its own normal reward. Balances at or below their fair floor were left untouched, and no balance was ever reduced below it.
This design deliberately distinguishes attackers from honest validators: the surplus is removed, but every legitimate validator keeps the rewards it fairly earned.
Verification
All outcomes are independently verifiable on-chain at the upgrade block (38,376,795):
- The reward contract was upgraded to the audited, guard-protected version.
- The supply reconciliation matched the published projection exactly.
- The network continued producing blocks through the upgrade and subsequent epoch settlements without interruption.
The reconciliation logic was reviewed to guarantee it is deterministic (identical for every node), applied exactly once, and cannot underflow or affect any balance below its fair level.
Recovery status
The on-chain reconciliation removed 186,153,491 CORE of the accelerated rewards balance from supply, permanently, by direct state reduction.
A further ≈69M CORE had been moved before the upgrade and was therefore beyond the reach of the on-chain reconciliation. The majority of this was dispersed by the attacker across a large number of external wallets ahead of the upgrade. Core Foundation is working closely with law enforcement and other partners to recover these funds, backed by a complete on-chain evidence trail.
Lessons & Next Steps
- Harden the reward path & reduce complexity. With the primary defenses proven, we will consolidate and simplify the related checks in a follow-up release.
- Independent Audit Review. The reward-accounting and reward-distribution paths have undergone additional independent review by Halborn.
Thanks
We’re grateful to the validators and node operators who upgraded quickly and coordinated through the response, and to the community for its patience while we resolved this safely. The network is healthy, the supply has been corrected, and staking rewards are back online.
Questions or independent analysis are welcome. The upgrade block, contract change, and reconciliation are all publicly verifiable on-chain.
