Cardano Network Disrupted by ‘Poisoned’ Transaction Attack

The price of Cardano (ADA) was down on Friday after the blockchain suffered an unexpected chain split, which was caused by a malformed delegation transaction that triggered a software flaw. That created problems for Cardano users, and prompted a public apology from the user who claimed that they caused it.

Intersect, the Cardano ecosystem’s governance organization, said in an incident report that the divergence began when the malformed transaction passed validation on newer node versions, but nodes running older software rejected it.

“This exploited a bug in an underlying software library that was not trapped by validation code,” Intersect wrote. “The execution of this transaction caused a divergence in the blockchain, effectively splitting the network into two distinct chains: one containing the ‘poisoned’ transaction and a ‘healthy’ chain without it.”

There was a premeditated attack from a disgruntled SPO who spent months in the Fake Fred discord actively looking at ways to harm the brand and reputation of IOG. He targeted my personal pool and it resulted in disruption of the entire cardano network.

Every single user was…

— Charles Hoskinson (@IOHK_Charles) November 21, 2025

Earlier that day, Cardano co-founder Charles Hoskinson posted on X that it was a “premeditated attack from a disgruntled [stake pool operator]” who was “actively looking at ways to harm the brand and reputation of [Cardano developer Input/Output Global].”

According to Hoskinson, all Cardano users were impacted. The price of Cardano’s token ADA was down more than 6% recently, following the incident.

According to the incident report, the mismatch caused operators to build blocks on different branches of the chain until patched node software was deployed. Developers and service providers coordinated an emergency response, and operators were urged to upgrade to rejoin the main chain.



Intersect said the wallet responsible for the malformed transaction has been identified, while Hoskinson said it will take weeks to clean up the mess.

“Forensic analysis suggests links to a participant from the Incentivized Testnet (ITN) era,” Intersect wrote. “As this incident constitutes a potential cyberattack on a digital network, relevant authorities, including the Federal Bureau of Investigation, are being engaged to investigate.”

Hours after the incident, an X user posting under the name Homer J. said they were responsible for submitting the transaction that triggered the split.

“Sorry Cardano folks, it was me who endangered the network with my careless action yesterday evening,” they wrote, describing the attempt as a personal challenge to reproduce the “bad transaction” and said he relied on AI-generated instructions while blocking traffic on their server.

“I’ve felt awful as soon as I realized the scale of what I’ve caused. I know there’s nothing I can do to make up for all the pain and stress I’ve caused over the past X hours,” they added. “Difficult to quantify the negligence on my behalf. I am sorry, I truly am. I didn’t have evil intentions.”

Update https://t.co/48YGQbF05R

— Charles Hoskinson (@IOHK_Charles) November 21, 2025

Homer wrote that he did not sell or short ADA, did not coordinate with anyone else, and did not act for financial gain. “I’m ashamed of my carelessness and take full responsibility for it and whatever consequences will follow,” he said.

According to Intersect, no user funds were lost, and most retail wallets were unaffected because they were running node components that handled the malformed transaction safely.

Hoskinson, the outspoken co-founder of Cardano, claimed in a video message that the network “didn’t go down,” though users did encounter issues before the problem was fixed.

“It is important to note that the network did not stall. Block production continued on both chains throughout the incident, and at least some identical transactions appeared on both chains,” Intersect wrote. “However, to ensure the integrity of the ledger, exchanges and third-party providers largely paused deposits and withdrawals as a precautionary measure.”

Source