---
title: "Radix Week in Review: The Incident Report, and One Exchange Back"
url: "https://radix.wiki/blog/week-in-review-2026-09-20"
updated: 2026-09-20
license: CC-BY-4.0
license_url: "https://creativecommons.org/licenses/by/4.0/"
version: "1.2.0"
---

# Radix Week in Review: The Incident Report, and One Exchange Back

| Week of | 14 to 20 September 2026 |
| --- | --- |
| Top story | The Radix Foundation published its report on the 31 August vault-authorisation defect. |

## The week in brief

- The [Radix Foundation](/ecosystem/radix-foundation) published its incident report on the 31 August exploit, naming a June 2023 tidy-up by RDX Works Limited as the origin and an August 2024 audit that missed it.
- KuCoin reopened XRD spot trading at 09:00 UTC on 18 September, the first venue to restart a book since the halt; Gate never stopped trading and still takes no deposits.
- [Hyperlane](/ecosystem/hyperlane) bridge routes are still offline, and the Foundation notices page lists no open notice.
- [hyperscale-rs](/contents/tech/research/hyperscale-rs) and hyperscale-vm took 408 commits between them, on six of the week’s seven days, from one contributor.
- [Leaf Node](/ecosystem/leafnode) now charges 100% on 25.59M XRD, and [Avaunt Staking](/ecosystem/avaunt-staking) charges 25% on 138.92M XRD, both as their queued requests said.
- Nothing in the Radix DAO’s document set is in force; the ratification discussion phase closed on 18 September.
- This week’s finding: the [Radix Engine](/contents/tech/core-protocols/radix-engine) already held the function that answers whether a caller may invoke a node, and called it in one place.

Mainnet has been committing rounds for nine days. What arrived this week is the written record of the ten days it did not: the Foundation’s account of the defect, the first exchange notice reopening XRD, and a governance timetable that has moved three times since 29 August.

Each of those is somebody’s summary of what happened. The engine source is not, and it is public, so this issue reads one against the other.

## The incident report

The Radix Foundation published [Public Incident Report: Vault-Authorisation Vulnerability and Loss of Network Liveness](https://www.radixdlt.com/blog/public-incident-report-vault-authorisation-vulnerability-2026) on 17 September, the first full account of the 31 August exploit from the organisation that maintains the node software. The [Radix Accountability Council](/ecosystem/radix-accountability-council) pointed its channel at the report at 15:59 UTC the same afternoon.

The report rules out three explanations before it gives its own: this was not a bridge failure, not a validator failure, and not a compromise of anyone’s keys. It was a defect in how the [Radix Engine](/contents/tech/core-protocols/radix-engine) enforced ownership of a vault when a reference to that vault was passed into smart-contract code, and the fix enforces the receiver capability before a method call frame is constructed: an ordinary method call on a vault is now rejected when the caller holds only a direct-access reference, while intentional direct access operations continue to work as designed.

Two attributions in it are new. The defect was introduced in June 2023 during a routine tidy-up of the engine carried out by RDX Works Limited, at the time the Foundation’s contracted protocol development partner, and the report says RDX Works were informed of the root cause and have yet to respond. It was then missed by Zellic’s independent audit of August 2024, despite that audit covering the kernel in which the defect sat; Hacken had audited the engine before the tidy-up and passed it. The root cause is given as three individually reasonable behaviours in the call frame reference model combining into an unsafe path.

The timeline runs from the first exploit transaction at 16:02 UTC on 31 August through 26 transactions to 16:57. Community validators escalated at 17:37, SEAL 911 was engaged at 18:09 and Zellic at 18:11, findings converged on the engine’s vault authorisation around 19:30, and between 20:30 and 23:30 enough validator stake went offline that consensus could not be reached. A candidate fix was presented at 11:00 on 1 September. The report gives no figure for what was taken, only the asset list: Hyperlane-bridged ETH, WBTC, USDT, USDC, BNB and SOL, plus the XRD spent on fees.

Five lessons close it. The first is that refactoring is a security event and needs separate reviewers and its own threat model. The second is that audits sample rather than prove, and should be supplemented with continuous automated analysis, including AI-assisted review of the kind the attacker is believed to have used. The fifth is that the coordinated liveness break worked and should be written down and rehearsed.

### What the source adds

The report describes the shape of the defect and does not name the function. It is worth naming, because the engine had it already.

`NodeVisibility::can_be_invoked` takes a node and a flag for direct access and answers whether the calling frame may invoke it. In [radix-engine 1.3.1](https://github.com/radixdlt/radixdlt-scrypto/blob/v1.3.1/radix-engine/src/kernel/call_frame.rs), the version running on mainnet on 31 August, it is defined at line 266 of `call_frame.rs` and called at line 651 of the same file, and nowhere else in the crate. That one call site sits in the code that copies a direct-access reference from one call frame into another, and it passes `true`. Nothing called it with `false`, which is the ordinary method path. The predicate guarded reference copying; it did not guard invocation, which is the unsafe path the root cause describes.

The same holds in the artifact the registry served rather than the repository: the published [radix-engine 1.3.1 crate](https://static.crates.io/crates/radix-engine/radix-engine-1.3.1.crate), SHA-256 `2ad6651220406b5055e6d60b6f9901e3936519d6a7d2c17ff46fa8cb494bd3fc`, carries one definition and one call.

[Pull request 2093](https://github.com/radixdlt/radixdlt-scrypto/pull/2093), merged at 17:33:31 UTC on 7 September, adds the second call site. A new `SystemVersion::V5` turns on `should_check_method_receiver_access`, which runs before every invocation: a direct method must have direct visibility of its receiver, a main or module method must have normal visibility, and a call with neither returns `SystemError::InvalidInvokeAccess`. Gating it on the system version is what lets the old behaviour replay for transactions already committed. The same change corrects a second thing on its way past: a Dugong-era exemption written as `>= V4` would have carried into V5, and it is now pinned to V4 alone. It shipped as [Eagle Ray](/contents/tech/releases/protocol-updates).

RADIX WIKIThe Receiver CheckRADIX ENGINE 1.3.1 AND 1.4.0WHAT THE ENGINE ALREADY HELDDEFINED1 functionCALLED IN 1.3.11 placeCALLED IN 1.4.02 placesNodeVisibility::can_be_invoked answers whether the calling frame may invoke a node.It is defined at call_frame.rs:266 and has been since before the drain.WHERE IT WAS CONSULTEDINVOCATION PATH1.3.11.4.0Copying a direct-access reference between call framesInvoking a direct method (recall, direct vault access)Invoking a main or module methodWHAT EAGLE RAY ADDEDSystemVersion::V5 turns on should_check_method_receiver_access, which runs thepredicate before every method invocation and rejects the call withSystemError::InvalidInvokeAccess.radixdlt-scrypto pull request 2093, merged 7 September 2026. Read 20 September 2026.radix.wiki

can_be_invoked is defined once in radix-engine and, in the 1.3.1 crate running on mainnet on 31 August, called once: when copying a direct-access reference between call frames. Eagle Ray adds the invocation-path call site.

## Trading reopens, the bridge does not

KuCoin published its notice at 05:25 UTC on 18 September and [resumed XRD trading](https://www.kucoin.com/news/flash/kucoin-resumes-radix-xrd-trading-on-september-18-2026) the same day: deposits and withdrawals were already back, a call auction opened at 08:00 UTC and the XRD/USDT book opened at 09:00. The notice gives no reason for the suspension. It is the first venue to restart an XRD book since the halt, and last week this series recorded that none had.

Reopening a book is not the same as reopening an exchange, and the two venues took different routes. Gate never suspended XRD trading at all: read on 20 September, its spot currency endpoint returns `trade_disabled` false and `withdraw_disabled` false, with `deposit_disabled` true on both the native and the wrapped route, so XRD can be sold and withdrawn there but not deposited. KuCoin’s endpoint returns deposits and withdrawals both enabled. One venue kept the market open and has not reopened the door; the other closed both and has now reopened both.

Cross-chain transfers have not come back with it. Timan of Astrolescent told the main Radix channel at 16:07 UTC on 17 September that Hyperlane is currently still offline and we are working with them to get it back up, and that RocketX cross-chain swaps resume once the exchanges do. The [Foundation notices page](https://www.radixdlt.com/notices), which is where an operator would look, reads There are no open notices.

On-ledger trading is recovering faster than that suggests. [Ociswap](/ecosystem/ociswap) recorded 3,443 swaps in the seven days to 20 September against 1,296 the week before, on 9.04M XRD of volume, while its pooled value fell 3.5% to 102.42M XRD. More trades, less depth.

## Hyperscale, and whose network it is for

The two Hyperscale repositories recorded 408 commits in the seven days to 20 September, 280 in [hyperscale-rs](https://github.com/hyperscalers/hyperscale-rs) and 128 in [hyperscale-vm](https://github.com/hyperscalers/hyperscale-vm), on six of the seven days, all by flightofthefox. That is 76% more than last week and the largest weekly total this series has recorded. A fortnight ago the same query returned 19.

The channel spent the week arguing about something else: whether Hyperscale should launch as its own network with its own token distribution, or be adopted by Radix. The case for a separate launch rests on XRD holdings that the arguing parties consider concentrated; the case against is that a new network has to buy exchange listings and liquidity that Radix already has. On 19 September a community member opened a second channel, @hyperscale_route, [saying](https://t.me/hyperscale_rs/12689) the split was so the main channel stays free of the things its author does not want to deal with.

That author answered the premise directly a few hours later.

> "hs-rs is an open source stack for launching networks. it is not an instantiation of a network. it does not need to be shilled, it does not need a shitcoin, it does not need validators (unless i decide to do a testnet)"
> — flightofthefox, in the hyperscale.rs channel, 19 September 2026

He added later the same evening that hs-rs makes trade-offs for high throughput and there is literally zero point using it unless you also have a plausible situation where you have hundreds of thousands, or millions of state transitions. The work is a library; who runs a network on it is not a question the repository answers. The full exchange is at [t.me/hyperscale_rs/12693](https://t.me/hyperscale_rs/12693).

## Governance

The Radix Accountability Council reported on 17 September that the discussion phase of the governance framework ratification ends on 18 September and the process moves to the next phase, and that it is still finalising documents and identity checks with MIDAO, the Marshall Islands service handling the DAO’s registration, expecting to finish on its side by Monday 21 September. Its update is at [t.me/RadixAccountabilityCouncil/1037](https://t.me/RadixAccountabilityCouncil/1037).

[radixdao.org/govern](https://radixdao.org/govern/) now lists 26 rule-bearing documents, 25 marked Signed · awaiting ratification with a published SHA-256 digest and the Roles Registry pending, all recorded in ratification proposal GP-PRE-1. The page states its own position plainly: Nothing here is in force yet. That has been true at every reading since 18 August, which is what settles a prediction below.

The registration timetable has moved again. On 29 August the council said filing would roll out from 31 August and the registry takes four to six weeks after submission; on 5 September the start became 7 September; on 7 September the sign-up was complete and submission was MIDAO’s to make; and on 17 September the council is still assembling what MIDAO needs. Six weeks from 21 September closes on 2 November.

## This week on the wiki

Read [Hyperlane Asset Drain and Network Halt](/contents/history/hyperlane-asset-drain-2026) this week. It was written from the commits and the ledger while the network was down, before anyone had published an account, and the sweep folded the Foundation’s report into it on 18 September. Reading the two together is the cheapest way to see which parts of the story were legible in public all along. Twelve pages changed in the seven days to 20 September:

- [The Network, Week by Week](https://radix.wiki/contents/tech/operations/network-weekly)
- [Wiki Maintenance Log](https://radix.wiki/contents/tech/operations/wiki-maintenance-log)
- [AcuiQ](https://radix.wiki/ecosystem/acuiq)
- [eMunie](https://radix.wiki/contents/tech/research/emunie)
- [Dan Hughes](https://radix.wiki/contents/history/dan-hughes)
- [RadixPlanet](https://radix.wiki/ecosystem/radixplanet)
- [Cobra stakes](https://radix.wiki/ecosystem/cobra-stakes)
- [Validator Subsidy Sunset](https://radix.wiki/contents/history/validator-subsidy-sunset)
- [Apollo Pool](https://radix.wiki/ecosystem/apollo-pool)
- [Radix Wiki Hackathon #1](https://radix.wiki/contents/history/radix-wiki-hackathon-1)
- [Ociswap](https://radix.wiki/ecosystem/ociswap)
- [Governance WG · Elect the Permanent RAC](https://radix.wiki/ideas/dao-elect-permanent-rac)

## The week on the ledger

Read live from the Radix Gateway at epoch 342,482, state version 558,981,414, on 20 September 2026.

| Reading | Value | Week on week |
| --- | --- | --- |
| Staked XRD | 4.87B XRD | +0.5% |
| Validators holding a third of stake | 8 | no change |
| Top ten share of stake | 40.03% | −0.14 points |
| Validators charging a fee they do not store | 81 | +2 |
| Ociswap swaps, seven days | 3,443 | +166% |
| Commits across tracked repositories | 408 | +76% |

The fee-divergence row moved for a reason worth naming. The stake sitting behind a charged fee that differs from the stored one rose from 2.90B to 3.08B XRD this week, and 138.92M of that increase is one validator: Avaunt Staking’s queued rise from 2% to 25% took effect at epoch 342,482, the epoch of this reading. [StakeSafe](/ecosystem/stakesafe) bought that validator on 21 August and filed the request five days later. Its substate still reads 0.02, because the engine does not rewrite the stored factor when a request lands, which is why every reading in this series uses the effective fee.

RADIX WIKIThe Week on the LedgerWEEK ENDING 2026-09-20STAKED XRD4.87B+0.5%36.0% of all XRDBIGGEST STAKE MOVE+10.86M XRDof +21.86M network-wideA THIRD OF STAKE8 validatorstop 10 hold 40.03%OCISWAP 7D VOLUME9.04M XRD3,443 swapsSTAKE CONCENTRATIONThe largest 8 validators together hold a third of all staked XRD.Largest 248.04M XRD – twelfth 107.76M XRD.FEES IN MOTION81 validators charge a fee different from the one stored in their substate – 61 ofthem active, with 3.08B XRD staked.Daffy (Supreme)5% → 20% at epoch 344,149 · 51.53M XRD stakedRadix Charts V22.5% → 15% at epoch 345,107 · 23.56M XRD stakedDoItForDan5% → 15% at epoch 345,108 · 9.56M XRD stakedTHE SERIES SO FARStaked XRD4.87BOciswap 7d volume9.04M2026-08-16 → 2026-09-20, one reading per weekTHE WEEK IN THE REPOSITORIESCOMMITS408+75.9%1 contributorLINES CHANGED≥36.1K+23.1K / -13.0KBUSIEST REPOSITORYhyperscale-rs280 commitsDAYS WITH A COMMIT6 of 72 active reposEpoch 342,482, state version 558,981,414. Repositories 2026-09-14 to 2026-09-20.radix.wiki

The week on the Radix ledger – read at epoch 342,482, state version 558,981,414.

## Concentration watch

Eight validators hold a third of all staked XRD, the same figure in all five readings this series has stored since 16 August, and the largest ten hold 40.03%, down from 40.17%. A third is the line that matters, because a colluding group above it can stop the network committing rounds. The restart did not disturb it: the largest validator holds 248.04M XRD and the twelfth holds 107.76M, so the eighth place is not close to changing hands.

## The ledger

Two claims came due. **Leaf Node’s fee reaches 100% at epoch 341,223: hit.** Read at epoch 342,483, state version 558,981,649, the Gateway returns an effective fee factor of 1 on 25,589,948 XRD, with no pending change; radixscan agrees, and reports the stored factor still at 1%. **At least one Radix DAO document moves from pending to in force: miss.** Read on 20 September, radixdao.org/govern lists 26 documents and states that nothing there is in force; the ratification vote has not been held, and the claim had a month.

Three claims recorded. Radix Charts V2’s fee rises from 2.5% to 15% at epoch 345,107, by 4 October. Gate re-enables XRD deposits, by 11 October. At least one Radix DAO governance document reads as in force with its digest on-ledger, by 1 November. Each check, and the full record of what has hit and missed, is on [the series index](/blog/week-in-review).

## What to watch

- **Daffy (Supreme) at epoch 344,149, around 26 September.** A queued rise from 5% to 20% on 51.53M XRD. Settled by the effective fee factor on validator_rdx1svug50cdlalm6plazajrmntf209j5azf57xeukuhx2hw7e7ut5mmz8.
- **MIDAO’s submission, from 21 September.** The council expects its own side finished that day. The registry takes four to six weeks after that, so a certificate of formation for RADIX DAO LLC is due between late October and 2 November.
- **The second exchange.** KuCoin reopened on 18 September without explaining the closure. Whether any other venue follows, and how it words the notice, is the clearest read available on how the incident is being assessed from outside.

## Corrections

This week’s ledger figure first rendered 9 of 7 days with a commit. GitHub selects commits by the date they were committed, and the figure counted the days they were written, so work pushed this week but written earlier fell outside the seven days it was being counted against. Both the capture and the figure now count inside the window, and the correct number is six of seven.

This issue first called KuCoin the first exchange to reopen after the halt. Gate restored XRD withdrawals before it and never suspended trading, so the accurate claim is narrower: KuCoin is the first venue to restart an XRD book. Corrected about an hour after publication, and the prediction recorded against it was rewritten to name Gate’s deposits.

## Everything else this week

Everything else this week, in one place.

### Protocol and tooling

- [babylon-node v1.4.0.0, the full Eagle Ray release](https://github.com/radixdlt/babylon-node/releases/tag/v1.4.0.0)
- [Scrypto v1.4.0 (Eagle Ray) on radixdlt-scrypto](https://github.com/radixdlt/radixdlt-scrypto/releases/tag/v1.4.0)
- [Cassandra, the consensus paper accepted at VLDB 2027](/contents/tech/research/cassandra)

### Ecosystem and dApps

- [Auctoritas Systems, shown in the developer channel ahead of a mainnet deployment](https://auctoritas-systems.com/)
- [Radix Arena, parimutuel race betting, running on Stokenet before mainnet](https://radixarena.lol/)
- [A community explorer dashboard back online after the halt](https://radix-community.genkipool.com/en/dashboard/explorer?network=mainnet)

### Governance and community

- [The Radix DAO document index, 26 entries, none in force](https://radixdao.org/govern/)
- [The Accountability Council on the report and the MIDAO timetable](https://t.me/RadixAccountabilityCouncil/1037)
- [hyperscale.rs on what the stack is and is not](https://t.me/hyperscale_rs/12693)

Next week the first of three queued fee rises lands, and the DAO registration either reaches the registry or does not.

### Sources

1. Radix Foundation, Public Incident Report: Vault-Authorisation Vulnerability and Loss of Network Liveness, 17 September 2026 — https://www.radixdlt.com/blog/public-incident-report-vault-authorisation-vulnerability-2026
2. radixdlt-scrypto pull request 2093, vault access, merged 7 September 2026 — https://github.com/radixdlt/radixdlt-scrypto/pull/2093
3. radix-engine 1.3.1, call_frame.rs, the version running on mainnet on 31 August 2026 — https://github.com/radixdlt/radixdlt-scrypto/blob/v1.3.1/radix-engine/src/kernel/call_frame.rs
4. radix-engine 1.3.1 crate as published to the registry — https://static.crates.io/crates/radix-engine/radix-engine-1.3.1.crate
5. Scrypto v1.4.0 (Eagle Ray) release, 7 September 2026 — https://github.com/radixdlt/radixdlt-scrypto/releases/tag/v1.4.0
6. babylon-node v1.4.0.0 release, 10 September 2026 — https://github.com/radixdlt/babylon-node/releases/tag/v1.4.0.0
7. KuCoin, resumption of Radix (XRD) trading, 18 September 2026 — https://www.kucoin.com/news/flash/kucoin-resumes-radix-xrd-trading-on-september-18-2026
8. Radix Foundation notices page, read 20 September 2026 — https://www.radixdlt.com/notices
9. Astrolescent on the Hyperlane bridge, 17 September 2026 — https://t.me/radix_dlt/1004021
10. Radix Accountability Council update, 17 September 2026 — https://t.me/RadixAccountabilityCouncil/1037
11. Radix DAO governance document index, read 20 September 2026 — https://radixdao.org/govern/
12. hyperscale-rs repository — https://github.com/hyperscalers/hyperscale-rs
13. hyperscale-vm repository — https://github.com/hyperscalers/hyperscale-vm
14. flightofthefox on what hs-rs is, 19 September 2026 — https://t.me/hyperscale_rs/12693

---

**Radix Week in Review series, Issue #13:** [← Previous: Issue #12, Sep 7–13, 2026](/blog/week-in-review-2026-09-13) · [All recaps](/blog/week-in-review) · [Subscribe](/week-in-review.xml)

_Previously:_ Radix mainnet restarted on 11 September running the Eagle Ray fix. Exchanges have not reopened XRD, and third-party records still carry the halt.