Pirate Chain exploit mints around 39.8 million ARRR, team proposes rollback

Pirate Chain, a privacy coin that shields every transaction by design, has a counterfeiting problem. A flaw in its source code allowed someone to mint around 39.8 million ARRR without authorization, roughly 20% of the token’s total supply at the time. The network is still running. Users, however, have been told to keep their hands off their wallets while developers work out how to undo the damage. What went wrong The vulnerability surfaced on October 14, 2026. It traced back to two separate validation failures connected to Ironwood, a network upgrade that Pirate Chain activated on October 3. The freshly minted tokens did not sit still. They were moved quickly into the Sapling shielded pool, the part of the network where balances and transfers are hidden by cryptography. Pirate Chain’s development team acknowledged that the shielded nature of these transactions could make it harder to trace where the illicit coins went next. One exchange moved fast. NonKYC flagged deposits tied to the exploit, restricted them, and blocked withdrawals to limit further risk. The response: freeze, pause, rewind Pirate Chain’s instructions were blunt. Users were asked not to move funds, and exchanges an...