Between July 13 and July 15, the Elastos team identified, contained, and fixed a vulnerability in the network’s cross-chain mechanism.
Approximately 7.62 million ELA was moved from a protocol-level cross-chain reserve through 2,309 transactions over roughly 24 minutes.
No user wallet, private key, or individual balance was accessed or altered. The incident affected protocol-level reserve funds, not user accounts.
The Elastos mainchain has been patched and is operating normally. As a precaution, the Elastos Smart Chain (ESC) and the cross-chain Arbiter service remain temporarily paused while validators prepare and test the upgrades required for a safe restoration.
Approximately 99.96% of the affected ELA remains frozen or contained on Elastos-controlled paths.
Of the affected amount, 1,585,252.004 ELA remains frozen on the Elastos mainchain at the incident address:
EfduuvdDcAgif8njgXNJUfsBumQf9yYP72
Version v0.9.9.6 prevents funds from being spent from, or sent to, this address. This preserves the balance, but does not transfer it back to the reserve, reissue it, redirect it, or automatically refund it. Recovery of this mainchain amount requires a separate, narrowly scoped, consensus-governed recovery process.
Around 3,000 ELA passed through third-party liquidity and cannot be cleanly reversed through network-level action without affecting unrelated liquidity providers.
Assurance
No user wallet, private key, or recorded individual balance was accessed or altered. No user has lost funds.
The mainchain vulnerability has been fixed at the consensus level. The remaining work is to restore full reserve backing, complete ESC-side remediation, and restart affected services without creating further risk for users or unrelated liquidity providers.
What Users Need to Know
- The ELA mainchain is operating normally.
- Ordinary ELA mainchain transfers remain available.
- ESC block production and Arbiter-mediated cross-chain transfers remain temporarily unavailable.
- Do not initiate ELA-to-ESC or ESC-to-ELA transfers until a restoration notice is published.
- Elastos will never request a seed phrase, private key, or payment in response to this incident.
By the Numbers
| Item | Approximate amount | Current status |
|---|---|---|
| Affected amount | 7.62 million ELA | Transaction-level reconciliation in progress |
| Routed onto ESC | 6,034,234 ELA | Subject to ESC-side remediation |
| Frozen on the mainchain | 1,585,252.004 ELA | Frozen and preserved, not yet recovered |
| In identified ESC wallets | 4,931,234 ELA | ESC consensus freeze planned before restart |
| In identified bridge-contract paths | 1,100,000 ELA | Contained, associated transfers to follow |
| Through third-party liquidity | Around 3,000 ELA | Not cleanly reversible without affecting unrelated liquidity providers |
Figures are preliminary and rounded unless otherwise stated. A reconciled transaction-level accounting will be published before reserve restoration and ESC restart.
What Happened
The cross-chain reserve holds ELA used to support transfers between the Elastos mainchain and its sidechains.
Under normal conditions, reserve funds can move only through authorised cross-chain transactions validated against the current authorised Arbiter set.
The vulnerability allowed an ordinary mainchain transaction to bypass that authorisation and spend reserve funds.
Approximately 6.03 million ELA was then routed through the normal cross-chain deposit path to ESC, where corresponding ELA was credited. Approximately 1.585 million ELA remained on the mainchain.
This temporarily left the ESC cross-chain reserve below its required 1:1 backing. Most affected value remains present on Elastos-controlled paths, but it has not yet all been returned to the reserve.
Where the Affected Funds Are Now
Mainchain
1,585,252.004 ELA remains at:
EfduuvdDcAgif8njgXNJUfsBumQf9yYP72
Mainchain consensus rules in v0.9.9.6 reject transactions that spend from, or send to, this address. The balance is frozen and preserved pending a separate recovery decision. It has not yet been returned to the reserve.
ESC Wallets
Approximately 4,931,234 ELA remains in identified incident-related ESC wallets.
ESC block production is currently paused. While the pause remains in effect, new ESC transactions cannot be finalised in blocks. This operational containment measure is separate from an ESC consensus-level address freeze.
The planned ESC consensus upgrade is intended to freeze the identified ESC balances before block production resumes.
Cross-Chain Bridge Contracts
Approximately 1,100,000 ELA entered identified bridge-contract paths.
The associated transfers were not completed as of this notice. They remain contained, but are not counted as recovered. Any bridge-side burn or recovery will be confirmed with an on-chain transaction reference.
Third-Party Liquidity and External Bridge Activity
Approximately 3,000 ELA was exchanged through third-party liquidity and became mixed with unrelated user liquidity.
Reversing that activity through network-level action would risk affecting innocent liquidity providers, so this portion is not considered cleanly recoverable.
The resulting assets were sent toward an external bridge, but the destination transaction remained unexecuted as of this notice.
Mainchain Fix
Elastos mainchain version v0.9.9.6 introduced consensus restrictions for CrossChain-prefixed UTXOs.
At mainchain block 2,256,110, on July 14 at 11:52 UTC, all CrossChain UTXO spends were temporarily rejected.
At block 2,256,724, on July 15 at 09:10 UTC, ongoing restrictions took effect. Only valid authorised bridge transaction types may spend CrossChain UTXOs. Ordinary transactions cannot spend CrossChain reserve UTXOs.
Separately, v0.9.9.6 freezes the single identified mainchain incident address:
EfduuvdDcAgif8njgXNJUfsBumQf9yYP72
Why ESC and the Arbiter Remain Paused
ESC block production and the cross-chain Arbiter service were paused on July 14 while the affected funds were traced and secured.
The Arbiter relays ELA between the mainchain and Elastos sidechains. The operational pause applies to ESC block production and Arbiter-operated cross-chain services while restart and recovery controls are verified.
The planned ESC upgrade is being prepared and rehearsed to:
- Freeze the identified ESC balances at the ESC consensus level.
- Enable a controlled restart of ESC and the Arbiter service.
- Support verification of corrected ESC supply and reserve position.
Restoring the frozen mainchain amount to the reserve is a separate mainchain recovery process. It requires separate approval, validation, and network coordination before full 1:1 backing can be claimed.
Next Steps
Current work is focused on:
- Completing and rehearsing the ESC consensus upgrade.
- Freezing the identified ESC balances at the consensus level.
- Coordinating contained bridge transfers with the relevant operators.
- Finalising and validating the separate mainchain reserve-recovery process.
- Independently reconciling ESC supply and reserve backing.
- Restarting ESC and the Arbiter after validator verification.
- Publishing upgrade, rollback, reindex, and resynchronisation instructions for operators, exchanges, indexers, and service providers.
Further notices will be published as ESC, the Arbiter, and full reserve backing are safely restored.
On-Chain References
- Mainchain reserve address:
XVbCTM7vqM1qHKsABSFH4xKN1qbp7ijpWf - Frozen mainchain incident address:
EfduuvdDcAgif8njgXNJUfsBumQf9yYP72 - Initial suspicious reserve-spend transaction:
d9f16318d05b87db2d21a2338b6393032dcebdd976fc0e6234df6adee5678b70 - Cross-chain transactions:
d5c65207243a17cbe9a1eed82d834c408d78d354798807f7517b674e9f59d662
54a9c3e453794a5d1f605715ba4ae49f0663715fc94c974ebffcfa7c48cc144a - ESC recipient address:
0x5132c2Fb6b727CD342Ee37C86D35D939FAb7744d - Technical release:
Elastos ELA v0.9.9.6
