Pirate Chain Exploit Created 39.8 Million New ARRR Tokens
Unauthorized tokens created through validation bypass
Pirate Chain, a privacy-focused blockchain, said an exploit allowed the creation of about 39.8 million new ARRR tokens. That raises the coin's total supply by roughly 20 percent.
The project announced the issue on Oct. 15 after detecting the vulnerability the day before. It asked users to stop moving funds while developers work on a recovery plan.
What happened and where the coins went
- The exploit created 39.8 million ARRR through two validation failures: a bypassed issuance check and incorrect interpretation of output scripts.
- The newly created coins were moved into the network's shielded pool, a privacy feature that hides transaction details. Because of this, the full trail of the funds cannot be traced.
- Crypto exchange NonKYC spotted suspicious deposits, restricted the related account, and blocked withdrawals.
- Pirate Chain believes the unauthorized activity was mostly limited to onchain transactions and did not involve exchange offchain funds.
Network safety measures taken
Pirate Chain runs a delayed Proof-of-Work system called dPoW, which helps protect against double-spending by notarizing transactions onto other blockchains, specifically Komodo Classic and Litecoin. Operators of dPoW agreed to temporarily suspend notarizations as a precaution.
Exchanges and mining pools were also asked to pause operations voluntarily. The blockchain itself remains online, but users are urged not to send or move funds until further notice.
What the project says about the cause
Pirate Chain said there is no evidence that notary keys were compromised or that the cryptography behind its shielded transactions was broken. The issue appears to be in the transaction-validation logic.
Recovery still under development
An earlier notice suggested developers might roll the chain back to Oct. 14 and linked the problem to the transparent supply-accounting layer associated with Ironwood. The later update clarified that the network is decentralized, so the team cannot freeze it or unilaterally change its history.
A recovery plan is still being developed in discussion with other communities. Technical details and recovery instructions will come in a future post-mortem report.
Why this matters
The incident raises questions about the security of privacy blockchains and their transaction-validation systems. The creation of 20 percent more tokens than intended could affect the coin's scarcity and market dynamics, though the project has not commented on those effects. Users holding ARRR are being asked to hold rather than trade while the situation is resolved.
What is confirmed
- 39.8 million ARRR were created through an exploit.
- The vulnerability was discovered on Oct. 14 and publicly announced on Oct. 15.
- Funds were moved to the shielded pool and cannot be fully traced.
- The network is operational but users are asked to pause transactions.
What is still unclear
- The exact recovery plan and whether a rollback is possible.
- Whether the exploited funds can be recovered or identified.
- The long-term impact on ARRR's supply and value.
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.