Pirate Chain (ARRR), a privacy-focused cryptocurrency, confirmed that an exploit discovered on October 14, 2026, allowed unauthorized creation of about 39.8 million ARRR, increasing the coin’s supply by about 20%. The project has also stepped back from an earlier plan to roll back its blockchain, saying its decentralized structure makes a unilateral rollback impossible.
The details came in a follow-up statement posted on X at 16:46 UTC (Coordinated Universal Time) on October 15, 2026. According to the project, the newly created coins were “immediately transferred into the Sapling shielded pool,” the part of the network where cryptography hides balances and transfers.
How the Exploit Worked
Pirate Chain said the attack combined two validation failures. The first was a bypassed issuance check, the rule meant to stop coins from being created outside the network’s protocol. The second was an incorrect interpretation of output scripts, the instructions in a transaction that define where coins are sent and how they can later be spent.
The project said evidence does not indicate any compromise of its notary keys or of the cryptography behind its shielded transactions. Pirate Chain applies zk-SNARKs to every transaction. Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs) are cryptographic proofs that confirm a transaction is valid without revealing the sender, receiver, or amount.
That privacy design also limits the investigation. The project said the full movement of the minted coins cannot be traced because of the nature of shielded transactions, though it believes related activity was “otherwise restricted primarily to on-chain transactions.”
NonKYC, a cryptocurrency exchange that does not require identity verification, identified suspicious deposits linked to the activity and restricted the associated account, preventing withdrawals, Pirate Chain said.
Rollback Plan Replaced by a Voluntary Pause
At approximately 02:20 UTC on October 15, Pirate Chain had announced that developers would roll the chain back to October 14, 2026, at 1:00 PM Pacific Time (PT), which is 20:00 UTC. That notice said exchanges had been informed and were temporarily suspending deposits and withdrawals. It also asked users not to send or receive funds. The Crypto Times reported on that initial rollback announcement at the time.
The later update revised that approach. Pirate Chain said it is “not possible to freeze the network or unilaterally rollback its blockchain history” because the network is decentralized.
The blockchain remains operational. As a voluntary precaution, operators of delayed Proof of Work (dPoW), a security system that periodically records Pirate Chain’s blockchain state onto another blockchain to guard against double-spending, collectively agreed to temporarily suspend these notarizations. Exchanges and mining pools have been asked to voluntarily pause operations while a recovery plan is developed, and users have been asked to temporarily refrain from sending or moving funds.
The team said it is investigating the incident and developing solutions in collaboration with other communities. Further technical details and recovery instructions are expected in a forthcoming post-mortem report.
Flaw Sat in Ironwood’s Supply Accounting Layer
Pirate Chain scheduled Ironwood’s mainnet activation for October 3, 2026, at 19:00 UTC. The upgrade moved the network directly from Sapling to a new shielded pool built on Halo2, a proving system that removes the need for a trusted setup- the one-time ceremony earlier zk-SNARK systems used to generate their cryptographic parameters. In doing so, Pirate Chain skipped Orchard, the shielded pool used by Zcash before its own Ironwood transition.
Ironwood was designed with machine-checked formal verification of its circuit, meaning its logic was checked mathematically by software. It also uses a turnstile, a mechanism that publicly tracks value entering and leaving shielded pools so the total supply can be audited even when individual transactions remain private.
According to the project, the vulnerability was located in the transparent accounting layer related to the Ironwood turnstile, not in the core shielded transaction cryptography. The flaw was discovered 11 days after Ironwood’s scheduled activation.
ARRR Market Data
ARRR traded at $0.2596 on October 16, 2026 at 07:22 AM UTC, down 6.5% over the prior 24 hours, with a market capitalization of $50.929 million and a fully diluted valuation of $51.912 million, according to CoinGecko market data.
Circulating supply stood at 196.214 million ARRR against a total supply of 200 million, while 24-hour trading volume was $484,310.
Pirate Chain has not confirmed any loss of existing user funds beyond the unauthorized minting itself.
Also Read: UNCX Exploit Escalates: Vesting V2 Bug Drains ~$1.5M Across 4 Chains as Copycats Join In
