Blockchain Funds Mismanagement in ixo Platform

CVE-2026-61604

What is CVE-2026-61604?

The ixo Blockchain, prior to version 8.0.0, contained a critical flaw in its x/bonds module that permitted unauthorized funds movement. This vulnerability was related to the handling of decentralized identifiers (DIDs), where an attacker could potentially resolve a victim's address without their consent and transfer tokens into an attacker-controlled bond. This exploit bypassed the need for victim credentials, leading to unauthorized access to user balances. The flaw has been addressed in version 8.0.0, which includes mandatory upgrades for all node operators and validators; the x/bonds module has been temporarily disabled to prevent further unauthorized transactions.

References