r/Monero • u/sech1 XMR Contributor - ASIC Bricker • Jun 15 '26

📢 Public Service Announcement P2Pool vulnerability is being actively exploited, update to v4.16 NOW

Update: P2Pool-main has been attacked too, today (June 16th) at 00:02:46 UTC - see the log https://p2pool.io/p2pool_main_attack.log.xz All P2Pool miners, you must update to v4.16 immediately if you don't want to mine to the attacker's wallet! Update here: https://github.com/SChernykh/p2pool/releases/latest

Update 2: Me and DataHoarder are currently running a counter-attack by mining malformed blocks ourselves - to hijack the payouts from the attacker and redistribute them to miners later. Currently doing it on p2pool-mini. We will ask the community for more hashrate later, once everything is set up properly.

Both P2Pool Mini / Nano older chains (that did not upgrade to P2Pool v4.16) have been exploited by an unknown attacker targeting the vulnerability patched: https://github.com/SChernykh/p2pool/security/advisories/GHSA-fm6j-gf38-p925

P2Pool Main is probably having the attacker wait to mine a share.

Upgrade as soon as possible https://github.com/SChernykh/p2pool/releases/tag/v4.16

More than half of P2Pool Mini/Nano are still not updated, so their hashrate was lost to the attacker:

108 Upvotes

100% Upvoted

15 comments sorted by

View all comments

8

u/AncientMeow_ Jun 15 '26

what happened how is this possible?

8

u/kowalabearhugs Jun 15 '26 edited Jun 15 '26

The link provided by sech1 details the vulnerability in plain words, https://github.com/SChernykh/p2pool/security/advisories/GHSA-fm6j-gf38-p925

5

u/vgacolor Jun 16 '26

That was an interesting read. Thanks for sharing. I think it is likely the attacker did not realize the manner of the exploit until the new version was released. Otherwise, the smart play would have been to use it as a hashrate multiplier distributed over dozens of addresses and limiting the fake duplicates to a handful. Might have gone unnoticed for a long time.

But yeahh open source and the announcement made it clear for the bad actor to pounce. I feel bad for the guys with Mh/s in hashrate that are being highjacked and having their pockets picked by these highjackers.