Cardano Splits In Two After Bug Exploit As Charles Hoskinson Says FBI Is Involved

Cardano co-founder Charles Hoskinson said the Federal Bureau of Investigation (FBI) is involved after a developer exploited a dormant node bug that split the $14 billion blockchain into two.

The split happened on Nov. 21 after a developer by the username Homer J on X, who acknowledge splitting the chain, said he performed “careless” actions in an effort to test a 3-year-old bug in the blockchain’s node software. 

“It started off as a ‘let’s see if I can reproduce the bad transaction’ personal challenge and then I was dumb enough to rely on AI’s instructions on how to block all traffic in/out of my Linux server without properly testing it on testnet first,” the developer wrote in an X thread after the incident. 

“I’ve felt awful as soon as I realised the scale of what I’ve caused,” the person said. ”I know there’s nothing I can do to make up for all the pain and stress I’ve caused over the past X hours.”

Hoskinson Says Exploit ‘Was Absolutely Personal’

Hoskinson rejected the contention that it was an accident. He said the developer’s exploit of the node bug “was absolutely personal,” and that the person was just “trying to walk it back because he knows the FBI is already involved.” 

“There was a premeditated attack from a disgruntled SPO who spent months in the Fake Fred discord actively looking at ways to harm the brand and reputation of IOG,” Hoskinson said. “He targeted my personal pool and it resulted in disruption of the entire Cardano network.”

Cardano Blockchain Splits In Two As Validators Failed To Reach Consensus

The Cardano ecosystem organization project Intersect said in a report that the incident happened at approximately 8:00 a.m. UTC on Nov. 21 when Homer J exploited “a bug in an underlying software library that was not trapped by validation code.”

More specifically, it took advantage of a bug in the deserialization of a hash, which the company said dates back to 2022. 

With that bug, the developer was able to push through “an oversized hash in a malformed delegation transaction to pass initial validation checks when it should have been rejected.” 

“Previous ledger versions and the usual transaction submission tooling had masked this bug, meaning that it was only triggered in recent node versions and using specialised tooling,” Intersect said. 

“The execution of this transaction caused a divergence in the blockchain, effectively splitting the network into two distinct chains: one containing the ‘poisoned’ transaction and a ‘healthy’ chain without it.” 

What raised suspicions that this was a pre-mediated attack was the fact that the exploit was used on the Cardano testnet just a day before the mainnet incident, according to Intersect. 

After the incident, the Cardano team and various other ecosystem partners quickly resolved the issue, according to Hoskinson.

Cardano Blockchain Reportedly Functioned As Usual, But Exchanges Were Hesitant

Intersect said in its report that the Cardano blockchain continued to function during the incident, and added that block production continued on both chains while the network was split. 

Major exchanges, including Coinbase, paused ADA deposits and withdrawals as they monitored which chain would secure consensus, while DeFi protocols and explorers briefly showed conflicting network states.

Coinbase documented the longest disruption, and suspended withdrawals and deposits from 12:15 a.m. UTC on Nov. 21 through 2:10 a.m. UTC on Nov. 22. Other exchanges, including Upbit and Kraken, implemented shorter pauses. 

Meanwhile, blockchain explorers had displayed conflicting information during the partition. Decentralized finance (DeFi) protocols also experienced inconsistent state across the split, with some smart contract interactions taking place on one chain while related transactions landed on the other. 

Some users also reported an increase in transaction times. Usually, transactions on Cardano are executed in seconds. However, the split saw several transactions take up to minutes to execute on-chain. 

The ADA price plunged as much as 16% on the news before stabilizing. It is up more than 1% in the last 24 hours to trade at $0.4130 as of 3:38 a.m. EST, data from CoinMarketCap shows. 

ADA price (Source: CoinMarketCap)