Radix Week in Review: The Incident Report, and One Exchange Back

The week in brief

• The Radix Foundation published its incident report on the 31 August exploit, naming a June 2023 tidy-up by RDX Works Limited as the origin and an August 2024 audit that missed it.
• KuCoin reopened XRD spot trading at 09:00 UTC on 18 September, the first venue to restart a book since the halt; Gate never stopped trading and still takes no deposits.
• Hyperlane bridge routes are still offline, and the Foundation notices page lists no open notice.
• hyperscale-rs and hyperscale-vm took 408 commits between them, on six of the week’s seven days, from one contributor.
• Leaf Node now charges 100% on 25.59M XRD, and Avaunt Staking charges 25% on 138.92M XRD, both as their queued requests said.
• Nothing in the Radix DAO’s document set is in force; the ratification discussion phase closed on 18 September.
• This week’s finding: the Radix Engine already held the function that answers whether a caller may invoke a node, and called it in one place.

Mainnet has been committing rounds for nine days. What arrived this week is the written record of the ten days it did not: the Foundation’s account of the defect, the first exchange notice reopening XRD, and a governance timetable that has moved three times since 29 August.

Each of those is somebody’s summary of what happened. The engine source is not, and it is public, so this issue reads one against the other.

The incident report

The Radix Foundation published Public Incident Report: Vault-Authorisation Vulnerability and Loss of Network Liveness on 17 September, the first full account of the 31 August exploit from the organisation that maintains the node software. The Radix Accountability Council pointed its channel at the report at 15:59 UTC the same afternoon.

The report rules out three explanations before it gives its own: this was not a bridge failure, not a validator failure, and not a compromise of anyone’s keys. It was a defect in how the Radix Engine enforced ownership of a vault when a reference to that vault was passed into smart-contract code, and the fix enforces the receiver capability before a method call frame is constructed: an ordinary method call on a vault is now rejected when the caller holds only a direct-access reference, while intentional direct access operations continue to work as designed.

Two attributions in it are new. The defect was introduced in June 2023 during a routine tidy-up of the engine carried out by RDX Works Limited, at the time the Foundation’s contracted protocol development partner, and the report says RDX Works were informed of the root cause and have yet to respond. It was then missed by Zellic’s independent audit of August 2024, despite that audit covering the kernel in which the defect sat; Hacken had audited the engine before the tidy-up and passed it. The root cause is given as three individually reasonable behaviours in the call frame reference model combining into an unsafe path.

The timeline runs from the first exploit transaction at 16:02 UTC on 31 August through 26 transactions to 16:57. Community validators escalated at 17:37, SEAL 911 was engaged at 18:09 and Zellic at 18:11, findings converged on the engine’s vault authorisation around 19:30, and between 20:30 and 23:30 enough validator stake went offline that consensus could not be reached. A candidate fix was presented at 11:00 on 1 September. The report gives no figure for what was taken, only the asset list: Hyperlane-bridged ETH, WBTC, USDT, USDC, BNB and SOL, plus the XRD spent on fees.

Five lessons close it. The first is that refactoring is a security event and needs separate reviewers and its own threat model. The second is that audits sample rather than prove, and should be supplemented with continuous automated analysis, including AI-assisted review of the kind the attacker is believed to have used. The fifth is that the coordinated liveness break worked and should be written down and rehearsed.

What the source adds

The report describes the shape of the defect and does not name the function. It is worth naming, because the engine had it already.

NodeVisibility::can_be_invoked takes a node and a flag for direct access and answers whether the calling frame may invoke it. In radix-engine 1.3.1, the version running on mainnet on 31 August, it is defined at line 266 of call_frame.rs and called at line 651 of the same file, and nowhere else in the crate. That one call site sits in the code that copies a direct-access reference from one call frame into another, and it passes true. Nothing called it with false, which is the ordinary method path. The predicate guarded reference copying; it did not guard invocation, which is the unsafe path the root cause describes.

The same holds in the artifact the registry served rather than the repository: the published radix-engine 1.3.1 crate, SHA-256 2ad6651220406b5055e6d60b6f9901e3936519d6a7d2c17ff46fa8cb494bd3fc, carries one definition and one call.

Pull request 2093, merged at 17:33:31 UTC on 7 September, adds the second call site. A new SystemVersion::V5 turns on should_check_method_receiver_access, which runs before every invocation: a direct method must have direct visibility of its receiver, a main or module method must have normal visibility, and a call with neither returns SystemError::InvalidInvokeAccess. Gating it on the system version is what lets the old behaviour replay for transactions already committed. The same change corrects a second thing on its way past: a Dugong-era exemption written as >= V4 would have carried into V5, and it is now pinned to V4 alone. It shipped as Eagle Ray.

Trading reopens, the bridge does not

KuCoin published its notice at 05:25 UTC on 18 September and resumed XRD trading the same day: deposits and withdrawals were already back, a call auction opened at 08:00 UTC and the XRD/USDT book opened at 09:00. The notice gives no reason for the suspension. It is the first venue to restart an XRD book since the halt, and last week this series recorded that none had.

Reopening a book is not the same as reopening an exchange, and the two venues took different routes. Gate never suspended XRD trading at all: read on 20 September, its spot currency endpoint returns trade_disabled false and withdraw_disabled false, with deposit_disabled true on both the native and the wrapped route, so XRD can be sold and withdrawn there but not deposited. KuCoin’s endpoint returns deposits and withdrawals both enabled. One venue kept the market open and has not reopened the door; the other closed both and has now reopened both.

Cross-chain transfers have not come back with it. Timan of Astrolescent told the main Radix channel at 16:07 UTC on 17 September that Hyperlane is currently still offline and we are working with them to get it back up, and that RocketX cross-chain swaps resume once the exchanges do. The Foundation notices page, which is where an operator would look, reads There are no open notices.

On-ledger trading is recovering faster than that suggests. Ociswap recorded 3,443 swaps in the seven days to 20 September against 1,296 the week before, on 9.04M XRD of volume, while its pooled value fell 3.5% to 102.42M XRD. More trades, less depth.

Hyperscale, and whose network it is for

The two Hyperscale repositories recorded 408 commits in the seven days to 20 September, 280 in hyperscale-rs and 128 in hyperscale-vm, on six of the seven days, all by flightofthefox. That is 76% more than last week and the largest weekly total this series has recorded. A fortnight ago the same query returned 19.

The channel spent the week arguing about something else: whether Hyperscale should launch as its own network with its own token distribution, or be adopted by Radix. The case for a separate launch rests on XRD holdings that the arguing parties consider concentrated; the case against is that a new network has to buy exchange listings and liquidity that Radix already has. On 19 September a community member opened a second channel, @hyperscale_route, saying the split was so the main channel stays free of the things its author does not want to deal with.

That author answered the premise directly a few hours later.

He added later the same evening that hs-rs makes trade-offs for high throughput and there is literally zero point using it unless you also have a plausible situation where you have hundreds of thousands, or millions of state transitions. The work is a library; who runs a network on it is not a question the repository answers. The full exchange is at t.me/hyperscale_rs/12693.

Governance

The Radix Accountability Council reported on 17 September that the discussion phase of the governance framework ratification ends on 18 September and the process moves to the next phase, and that it is still finalising documents and identity checks with MIDAO, the Marshall Islands service handling the DAO’s registration, expecting to finish on its side by Monday 21 September. Its update is at t.me/RadixAccountabilityCouncil/1037.

radixdao.org/govern now lists 26 rule-bearing documents, 25 marked Signed · awaiting ratification with a published SHA-256 digest and the Roles Registry pending, all recorded in ratification proposal GP-PRE-1. The page states its own position plainly: Nothing here is in force yet. That has been true at every reading since 18 August, which is what settles a prediction below.

The registration timetable has moved again. On 29 August the council said filing would roll out from 31 August and the registry takes four to six weeks after submission; on 5 September the start became 7 September; on 7 September the sign-up was complete and submission was MIDAO’s to make; and on 17 September the council is still assembling what MIDAO needs. Six weeks from 21 September closes on 2 November.

This week on the wiki

Read Hyperlane Asset Drain and Network Halt this week. It was written from the commits and the ledger while the network was down, before anyone had published an account, and the sweep folded the Foundation’s report into it on 18 September. Reading the two together is the cheapest way to see which parts of the story were legible in public all along. Twelve pages changed in the seven days to 20 September:

The week on the ledger

Read live from the Radix Gateway at epoch 342,482, state version 558,981,414, on 20 September 2026.

The fee-divergence row moved for a reason worth naming. The stake sitting behind a charged fee that differs from the stored one rose from 2.90B to 3.08B XRD this week, and 138.92M of that increase is one validator: Avaunt Staking’s queued rise from 2% to 25% took effect at epoch 342,482, the epoch of this reading. StakeSafe bought that validator on 21 August and filed the request five days later. Its substate still reads 0.02, because the engine does not rewrite the stored factor when a request lands, which is why every reading in this series uses the effective fee.

Concentration watch

Eight validators hold a third of all staked XRD, the same figure in all five readings this series has stored since 16 August, and the largest ten hold 40.03%, down from 40.17%. A third is the line that matters, because a colluding group above it can stop the network committing rounds. The restart did not disturb it: the largest validator holds 248.04M XRD and the twelfth holds 107.76M, so the eighth place is not close to changing hands.

The ledger

Two claims came due. Leaf Node’s fee reaches 100% at epoch 341,223: hit. Read at epoch 342,483, state version 558,981,649, the Gateway returns an effective fee factor of 1 on 25,589,948 XRD, with no pending change; radixscan agrees, and reports the stored factor still at 1%. At least one Radix DAO document moves from pending to in force: miss. Read on 20 September, radixdao.org/govern lists 26 documents and states that nothing there is in force; the ratification vote has not been held, and the claim had a month.

Three claims recorded. Radix Charts V2’s fee rises from 2.5% to 15% at epoch 345,107, by 4 October. Gate re-enables XRD deposits, by 11 October. At least one Radix DAO governance document reads as in force with its digest on-ledger, by 1 November. Each check, and the full record of what has hit and missed, is on the series index.

What to watch

• Daffy (Supreme) at epoch 344,149, around 26 September. A queued rise from 5% to 20% on 51.53M XRD. Settled by the effective fee factor on validator_rdx1svug50cdlalm6plazajrmntf209j5azf57xeukuhx2hw7e7ut5mmz8.
• MIDAO’s submission, from 21 September. The council expects its own side finished that day. The registry takes four to six weeks after that, so a certificate of formation for RADIX DAO LLC is due between late October and 2 November.
• The second exchange. KuCoin reopened on 18 September without explaining the closure. Whether any other venue follows, and how it words the notice, is the clearest read available on how the incident is being assessed from outside.

Corrections

This week’s ledger figure first rendered 9 of 7 days with a commit. GitHub selects commits by the date they were committed, and the figure counted the days they were written, so work pushed this week but written earlier fell outside the seven days it was being counted against. Both the capture and the figure now count inside the window, and the correct number is six of seven.

This issue first called KuCoin the first exchange to reopen after the halt. Gate restored XRD withdrawals before it and never suspended trading, so the accurate claim is narrower: KuCoin is the first venue to restart an XRD book. Corrected about an hour after publication, and the prediction recorded against it was rewritten to name Gate’s deposits.

Everything else this week

Next week the first of three queued fee rises lands, and the DAO registration either reaches the registry or does not.

Radix Week in Review series, Issue #13: ← Previous: Issue #12, Sep 7–13, 2026 · All recaps · Subscribe

Previously: Radix mainnet restarted on 11 September running the Eagle Ray fix. Exchanges have not reopened XRD, and third-party records still carry the halt.