CORE Transfers Halted as Core DAO Prepares Emergency Fork

Malicious validators contained after excess reward issuance

Core said on September 1 that it had contained the issue and stopped what it described as malicious validators from drawing further excess rewards. The network is now working with validators on a permanent fix through a forward upgrade, meaning previously confirmed transactions will remain unchanged. Core said assets remain safe and that a full technical postmortem would be published after the response is completed.

The project has not disclosed the amount of CORE distributed through the incident, the number of validators involved, how long they were able to obtain the excess rewards, or whether any of the additional tokens reached the market. Core first disclosed the problem on August 31, when it said a small number of validators were accruing block rewards significantly above the amount intended under the protocol.

Emergency hard fork will not reverse transactions

The distinction between a forward upgrade and a rollback means the planned fork is intended to change the network rules from a specified point without rewriting transactions already recorded on the blockchain. Mainnet upgrades can require coordination between validators and other network participants because nodes must run compatible software after new protocol rules take effect.

Core has not said whether validators will need to install a specific software release before the emergency upgrade or what level of validator participation will be required for the fork. The project has not published an activation time for the upgrade or disclosed the technical vulnerability that allowed the excess rewards to be claimed.

Exchanges restrict CORE transfers

The reward problem led several centralized exchanges to restrict CORE deposits or withdrawals while the network investigated the incident. Coinbase paused sends and receives on the Core DAO network, though trading functions remained available. South Korean exchanges Bithumb and Coinone suspended CORE deposits and withdrawals, citing security concerns. Bitget restricted CORE deposits and withdrawals under what it described as wallet maintenance, while LBank suspended deposits in response to project requirements.

The exchanges did not attribute losses of customer funds to the Core incident. Core has maintained that user assets were not affected and said the problem involved the issuance of validator rewards. The project has yet to disclose whether the exchanges will need to complete technical work related to the hard fork before normal CORE transfers can resume.

Validator reward system under scrutiny

The unanswered questions center on the amount of CORE obtained by the validators and the mechanism that allowed them to receive more than the protocol intended. Core has not said whether the excess rewards represented newly created CORE, rewards that would otherwise have been distributed at a later date, or another accounting problem within the validator reward system.

Core has spent the past several years building its network around Bitcoin staking and decentralized finance applications. In March 2025, Core integrated with Cobo to expand its dual Bitcoin staking service for institutional users in Asia, allowing Cobo users to stake Bitcoin and CORE while earning BTC-denominated yields. At that point, institutions had used Core to stake more than 6,200 BTC, while more than 150 Ethereum Virtual Machine-compatible decentralized applications had been integrated into the ecosystem. Core's total value locked stood above $525 million when the partnership was announced.

Emergency upgrade follows other recent hard forks

Core's planned response comes shortly after other blockchain networks used hard forks to modify protocol rules. BNB Chain activated its Pasteur hard fork on August 25 after scheduling changes to bridge verification, validator rewards, and protocol parameters. The Core incident highlights the ongoing challenges blockchain networks face in maintaining validator reward integrity and the importance of rapid response mechanisms when protocol rules are exploited.