Ontology forces urgent node upgrade after restarting chain hit by malicious activity

The Ontology blockchain network resumed mainnet operations on September 2, 2026, following an emergency security pause initiated on August 31, 2026, due to malicious attack activity. Ontology made sync-node software version 3.1.5 mandatory for all operators to maintain compatibility. While Ontology stated that user assets were not compromised, the specific attack vector remains undisclosed, and the recovery status of wider ecosystem services like exchanges and wallets is unconfirmed.

Ontology mainnet security pause

• ▪Ontology paused its mainnet on August 31, 2026, after finding a potential security concern during a daily security check.
• ▪During the mainnet pause, Ontology suspended block production, leaving on-chain transactions unprocessed, and advised users not to attempt time-sensitive transactions.

Mandatory node upgrade requirement

• ▪Ontology resumed its mainnet on September 2, 2026, and made sync-node software version 3.1.5 mandatory for all operators to maintain compatibility and stable synchronization.
• ▪Ontology instructed sync-node operators to upgrade to version 3.1.5 as soon as possible, confirm full synchronization, and verify normal operations.

Malicious network attack activity

• ▪On September 1, 2026, Ontology escalated its description of the network pause, confirming that its team had identified malicious attack activity targeting the network.
• ▪Ontology stated that its investigation found the malicious attack activity did not involve or compromise user assets.

Code changes vulnerability remediation

• ▪The parent commit of the Ontology version 3.1.5 release on GitHub modifies cross-chain message deserialization.
• ▪The Ontology version 3.1.5 code release on GitHub disables registrations for several legacy native contracts at mainnet block 20,770,894.

Undisclosed attack vector details

• ▪The Ontology version 3.1.5 release on GitHub provides a Linux AMD64 binary and checksum but does not include an incident explanation.
• ▪Ontology has not disclosed the specific attack path, identified the vulnerability, or provided forensic evidence or a postmortem report for the malicious activity.

Ecosystem service recovery status

• ▪Ontology has not disclosed whether public RPC providers, exchange deposits and withdrawals, wallets, or decentralized applications have resumed normal operation following the mainnet restoration.
• ▪Ontology stated that network monitoring will continue in coordination with its technical and security partners.

1 source