Pirate Chain Retracts Its Rollback Plan After 39.8M ARRR Minted

Pirate Chain told holders on Thursday that it would rewind its blockchain to undo a minting exploit. By Thursday evening the team had withdrawn that plan, saying it could not freeze or rewind the chain on its own. The exploit surfaced on 14 October and produced about 39.8 million ARRR, roughly a fifth of the privacy coin's supply, all of it moved straight into the network's shielded pool. The chain is still running. A post-mortem and a recovery plan are promised and neither has arrived.

Two checks that both failed

The flaw sits on the transparent side of the network, not in the cryptography. Pirate Chain runs shielded transactions, meaning sender, receiver and amount are hidden behind zk-SNARK proofs, and it uses a turnstile to account for supply as coins cross between its transparent and shielded layers. That turnstile arrived with Ironwood, an upgrade activated on mainnet on 3 October; The Crypto Times puts the activation at 19:00 UTC. Eleven days later an attacker combined two validation failures, a bypassed issuance check and an incorrect reading of output scripts, to create coins the ledger accepted. The Crypto Times and Coin Gabbar describe the pair of failures in those terms. Crypto Briefing names two failures and ties them to Ironwood without naming the turnstile.

The plan lasted about fifteen hours

A statement posted at about 02:20 UTC on 15 October said developers would revert the chain to its state at 20:00 UTC on 14 October, discarding every block after the exploit window. A second statement at 16:46 UTC the same day said otherwise.

It is "not possible to freeze the network or unilaterally rollback its blockchain history," the team said, because the network is decentralised.

Voluntary pauses replaced the rollback. Operators of the chain's delayed proof-of-work notarisation agreed to suspend notarising, exchanges and mining pools were asked to stop, and holders were asked not to move funds. Crypto Briefing, filing at 23:38 UTC on 15 October, carried only the rollback plan and treated it as live. Its account was out of date when it published. A rewind is not always beyond reach: Cronos restarted its chain with the Tectonic exploit rolled back in September, though that took a validator set willing to coordinate.

Where the coins went

Into the Sapling shielded pool, immediately, by every account checked. The team says they cannot be fully traced from there. NonKYC flagged deposits linked to the activity and restricted the account behind them, blocking withdrawals; that is the only exchange action any outlet names. The team's first post said all exchanges had been notified and were suspending deposits and withdrawals, and Coin Gabbar says plainly that which venues actually did so is unconfirmed. Nothing in the sweep points to the notary keys or the proving system being compromised.

The supply numbers do not add up

Friday's market data does not square with the exploit. CoinGecko listed ARRR circulating supply at 196.214 million against a 200 million maximum, which leaves no room for 39.8 million new coins, yet the same reports carry both the 20% increase and the cap. The Crypto Times states that the listing has not been reconciled with the increase. Coin Gabbar marks its own explanation, that the listing excludes the minted coins, as the author's inference. Neither resolves it and nor can we.

The price readings disagree too. The Crypto Times put ARRR at $0.2596, down 6.5% over 24 hours, and Coin Gabbar at $0.2614, down 4.0%, both citing CoinGecko on 16 October. They are snapshots taken hours apart on the same day and neither supersedes the other. Coin Gabbar adds that no source ties the fall to the exploit at all. Block heights for the exploit window are absent from every account, as is any confirmation that holders lost funds beyond the unauthorised minting. An issuance check can fail without anyone noticing: RippleX patched an overflow bug in the XRPL payment engine earlier this month before it was used. Pirate Chain's was used first and found afterwards.