Pirate Chain counterfeit ARRR mint and rollback

Not stated in USD. Pirate Chain states ~39.82 million counterfeit ARRR were minted and that the rollback removed the counterfeit issuance, returning balances to their pre-exploit state.

Root cause: Per Pirate Chain: the exploit combined two validation failures, bypassing the issuance check and incorrect interpretation of output scripts.

Timeline, as sourced: 14 Oct 2026; rollback target block 4,176,944 (14 Oct 2026 19:55:14 UTC); v6.0.14 announced on X as mandatory 22 Oct 2026 00:54 UTC; GitHub release notes call 6.0.14 recommended and 6.0.10 (released 18 Oct 2026) the mandatory security release.

On 14 October 2026, an attacker minted approximately 39.8 million unauthorized ARRR on Pirate Chain, increasing supply by about 20%, and moved the coins into the Sapling shielded pool. In its exploit update (opens in a new tab), the project said the attack combined two validation failures: a bypass of the issuance check and incorrect interpretation of output scripts. It said there was no evidence of compromised notary keys or of a break in the shielded-transaction cryptography. On 22 October the project announced mandatory release v6.0.14 (opens in a new tab), which rejects the exploit block. By consensus among node operators, pools, exchanges and dPoW notaries, the chain was rolled back to block 4,176,944, and the project says the counterfeit issuance was removed. The project's GitHub release notes for 6.0.14 (opens in a new tab) call it a recommended update with no consensus change, and name 6.0.10 (opens in a new tab) as the mandatory security release. A full technical post-mortem is pending.