Cardano Works to Restore Network After Targeted Chain Split

Cardano’s blockchain encountered a major disruption on November 22, 2025, after a specially crafted delegation transaction caused the mainnet to split into two parallel chains. The issue surfaced when Cardano founder Charles Hoskinson detected unusual activity during executive sessions in London. He reportedly characterized the event as unexpected but manageable, emphasizing that the system remained functional despite the anomaly.

Initial analysis suggested that the transaction exploited a cryptographic library flaw that had been present since 2022. The attack was first seen on the testnet and later replicated on the mainnet, specifically targeting Hoskinson’s own stake pool known as Rats Pool. This resulted in the creation of two simultaneous chains, prompting immediate action from engineering teams working across key ecosystem organizations.

Rapid Response From Core Teams and Stake Pools

Technical teams from Cardano Foundation, Intersect, Emurgo, and various stake pool operators quickly implemented hotfixes to stabilize the network. Although both chains continued producing blocks independently, developers indicated that the healthier chain — the one without the corrupted transaction — was expected to surpass and replace the compromised chain. However, they also acknowledged that some transactions recorded on the orphaned chain would later require manual reconciliation.

During the mitigation period, major exchanges paused deposits and withdrawals to avoid processing transactions on the wrong chain. Stake pool operators were instructed to upgrade to node version 10.5.3 to support full restoration. Hoskinson noted that these operators played a crucial role in implementing new updates and ensuring uninterrupted access for end users.

To streamline the reconciliation process, teams focused on comparing block histories between the two chains to determine which transactions should be retained. Intersect established a dedicated working group to supervise this effort and ensure all orphaned transactions were reviewed properly.

Mainnet Incident Update

Cardano experienced a temporary chain partition today after a malformed transaction triggered a bug in an underlying software library.

The ecosystem moved fast in a coordinated response. Upgrades to node version 10.5.2/10.5.3 are restoring full…

— Intersect (@IntersectMBO) November 21, 2025

Forensic Findings and Legal Follow-Up

Investigators determined that the attack was highly targeted. Digital forensics traced the malicious transaction to a retired pool linked to the Incentivized Testnet, widely known as ITN. Given the nature of the exploit and its impact on network integrity, authorities stated that the case falls under felony statutes in several jurisdictions. Agencies such as the FBI are expected to take part in the investigation.

Further to this morning’s update from our colleagues at @IntersectMBO regarding a technical issue on Cardano Mainnet, the Cardano Foundation is continuing to work with SPO’s and the broader team at @InputOutputHK, @IntersectMBO, and @emurgo_io to address the issue.

IMPORTANT…

— Cardano Foundation (@Cardano_CF) November 21, 2025

Despite the seriousness of the incident, Hoskinson expressed confidence in the response demonstrated by Cardano’s ecosystem teams. He described the coordinated action as a strong example of professionalism under pressure. He also acknowledged that 2025 had been challenging for the crypto sector due to volatile markets and governance-related growing pains, but said the resolution of this issue highlighted the network’s resilience.

Following an issue identified in the Preview environment yesterday, Cardano is currently experiencing a technical issue now on Mainnet.

Currently block production has slowed, and we’re working closely with @Cardano_CF and @InputOutputHK as we coordinate a technical response.…

— Intersect (@IntersectMBO) November 21, 2025

Path to Full Recovery and Future Safeguards

Cardano’s next step involves a full review of the vulnerability that enabled the malformed transaction. The goal is to prevent similar hidden bugs from bypassing security measures in the future. Retail users have been assured that no action is required on their part, while stake pool operators have been urged to complete their upgrades promptly.

Exchanges have begun gradually resuming normal operations as reconciliation progresses. Developers noted that once all operators complete updates, the two chains will merge, and full network functionality will be restored.

Hoskinson indicated that the ecosystem’s strong coordination and swift execution ensured the situation did not escalate further, reinforcing Cardano’s long-term commitment to security and operational stability.