Login

r/tari

What is up with XTM/tari on NonKYC?? (ALL Closed/Investigation)
▲ 10 r/tari+1 crossposts

What is up with XTM/tari on NonKYC?? (ALL Closed/Investigation)

I don't know what to say about this.

Apparently, due to the:

  • Wallet bug on September 29th.
  • The September 6th (C29 Proofs incident).
  • The September 22nd Hard Fork at Block 350,000.

The Tari network has temporarily suspended inbound transactions on several platforms to stop users from mining directly to exchanges.

This resulted in -- see attached screenshot.

And, No Dates for the resumption of services has been provided!!

Can someone tell us:

  1. The steps to Secure our mining operations? (minotari_node, minotari_miner, minotari_console_wallet)
  2. Does any of this impact "merge mining" with P2pool and Monero?
  3. When will Deposits, Withdrawals, Swaps; be available again?
u/tshureih — 11 days ago
▲ 9 r/tari

prompt: create a short doco about the most promising private, programmable money

i'm hyped for the ootle, how about you? 🐢

u/proofofjoseph — 10 days ago
▲ 8 r/tari

Tari Wallet Security Incident

On September 29, 2026, an exchange reported deposits that appeared confirmed in its Tari wallet but could not be spent. Contributors traced the problem to a wallet bug (not a protocol bug) that allowed an attacker to make deposits appear worth more XTM than their actual value.

This bug does not affect XTM in individual users’ wallets. Community members only need to ensure they are running the latest version of Tari Universe (v1.6.15). Tari contributors have successfully patched the wallet, notified exchanges, and updated the bridge.

What happened

The affected wallet code checked whether an incoming payment’s claimed amount matched its actual value but ignored the result. An attacker could send one micro-Tari and have the receiving wallet record a much larger amount.

The bug did not create XTM or increase the supply. The network continued to reject attempts to spend the inflated amounts. No hard fork is required.

The Timeline

September 29

20:41. The affected exchange reports through its partner channel: a depositor has been credited with XTM it cannot spend. The user has been frozen.

23:23. The attack is proven on the testnet. A proof-of-concept exists: a transaction that, to a wallet, validates as having sent an arbitrary amount of XTM, while the commitment on-chain commits to 1 µT. The detector built during the triage finds three forged outputs on Esmeralda.

23:29. The assessment from the exchange: the attacker has moved on to other exchanges. Contributors with exchange contacts are flagged immediately.

00:39 (September 30). An early advisory is drafted for the exchanges.

01:06. All exchanges are notified; the first acknowledgments arrive within the hour.

01:16. The detection tool is confirmed against every test case that could be constructed, and sent out with build instructions, requirements, usage, and expected results.

01:28. Tool source is distributed to all notified exchanges.

01:49. Every notified exchange has acknowledged.

September 30

05:49. The wallet fix is complete.

09:15. The bridge is placed in maintenance mode while the team scans its own wallet and upgrades for prevention.

The Fix

Contributors scanned 20,000 mainnet blocks during the response and found no instances of the detectable variant of the attack. The patched release corrects the wallet verification bug and includes a database migration that marks forged outputs invalid. Exchange and wallet operators should install the full update, including the migration.

Every exchange partner was contacted within hours of the attack being confirmed, and every notified exchange acknowledged, most within two hours. The wallet fix went out within hours of the root cause being confirmed.

If you have questions, please reach out on the official Tari Telegram channel or Discord server.

reddit.com
u/Blockchain_Surfer — 12 days ago
▲ 5 r/tari

September Ootle contest wrapped, here are my top picks (and October is live)

The September contest is done, and the turnout was genuinely impressive, builders across multiple disciplines shipping real apps before mainnet even launches. Here are the three that stood out to me:

1. Caravel (@caravelxyz)

A private neo bank on the Ootle. Wallet with private and public balances, plus encrypted chat with payments built in. This one's my own project, and I'm backing it all the way.

https://x.com/Caravelxyz/status/2104892257396535768

2. Tari L1 Web Wallet (by Erebus Lab)

A browser-based Tari wallet with an Ootle account built in. Its standout feature is burning XTM to the Ootle in one click, auto-claimed to your Ootle account. Effectively the on-ramp to the L2.

https://x.com/Erebus_Lab/status/2105254665265016978

3. Private Ballot (by GSXRspartan)

Open-source anonymous voting built on Tari's Triptych ring proofs. Prove you're an eligible voter without revealing who you are, with results anchored to the Ootle. A great example of Tari privacy beyond payments.

https://x.com/phillip_d33221/status/2096997652789613011

October contest is now live

Theme is Spooky Secrets, the best demonstration of Tari's privacy capabilities. 1M XTM for first, 500K second, 250K third. Note this month entries must be announced on Bluesky or Reddit, so this sub is a valid place to post yours.

https://community.tari.com/t/october-build-contest-thread-spooky-secrets/396

Builders, assemble 🐢

reddit.com
u/Okan01616161 — 13 days ago