MultiversX Keeps Mainnet Paused After Exploit Attempt

Updated on 09/20/2026 02:29:22

Engineers have prepared a fix that still needs testing, while the team evaluates how to correct incident-related state changes and preserve legitimate activity.

Key Takeaways

MultiversX says an attempted exploit caused invalid state changes, prompting a pause in network progression.
Engineers have prepared a fix, but mainnet deployment depends on successful testing; a separate recovery plan remains under evaluation.

Details

MultiversX said its mainnet remained paused after an attacker attempted to exploit an atomicity issue in its virtual machine. In a September 19 update published at 16:04 UTC, the team said the attempt had produced invalid state changes and that the pause was intended to prevent further impact.

Engineers have prepared a fix and plan to validate it on a shadow fork before coordinating mainnet deployment with validators, exchanges and infrastructure partners. The update did not announce successful testing or give a restart time.

The team is also assessing a targeted recovery approach. Its stated aim is to address changes linked to the incident while preserving finalized transaction history and legitimate user state.

For users, the immediate concern is moving assets while the incident response continues. MultiversX asked users to wait for an all-clear and to avoid submitting or rebroadcasting transactions, including EGLD and ESDT deposit and withdrawal routes through exchanges or bridges.

The team said it would publish a full technical incident report after completing its response and finalizing its findings. Its update did not quantify losses or identify affected accounts.

Market Analysis

The response has two distinct tasks: validating the software fix and deciding how to correct the invalid state changes. A patch could address the underlying flaw while still leaving recovery work to complete. The proposed coordination with exchanges and infrastructure providers also matters for asset transfers: users need a clear reopening signal from the services they use, alongside confirmation from the network.