Cheeta ·
The weird episode of Charles Hoskinson and Cardano with the FBI:
- a deserialization flaw in Cardano core code sits unnoticed since 2022
- the bug allows a malformed delegation transaction with an oversized hash
- this creates a risk where updated nodes accept the transaction while legacy nodes reject it
November 21 around 8:00 UTC
- a crafted delegation transaction goes live
- the network splits into two parallel chains
- about 30 to 40% of nodes follow a poisoned chain
- the rest reject the transaction and stay on the healthy chain
- wallets and dApps on the poisoned side stop working
- stake pool operators miss block rewards
- Binance and other exchanges pause ADA deposits and withdrawals
the attacker
- a user under the name Homer J
- says it was a personal challenge
- says AI helped him recreate the faulty transaction
- confirms similar tests were done before on the Cardano Preview testnet
Charles Hoskinson responds
- frames the incident as a planned cyber attack
- announces direct contact with the FBI
- activity in the anti IOHK Discord group Fake Fred
recovery phase
- emergency hotfix released in versions 10.5.2 and 10.5.3
- stake pool operators rush to update nodes
- chain convergence achieved within 24 hours
- FBI confirms an active investigation
- classified as potential federal cybercrime
one of the first known cases where a proof of stake disruption leads to law enforcement action
Weird.
