Core DAO‘s emergency hard fork is moving forward after a subset of validators extracted more CORE token rewards than the protocol was designed to issue, exposing a flaw in the reward distribution logic at the heart of the network.
Core has confirmed the incident is contained. The planned upgrade is a forward fork: no chain rollback, no reversal of confirmed transactions. That framing matters because it preserves finality for anyone who transacted on the network during the window when the bug was active.
What the Core DAO Emergency Hard Fork Actually Fixes
On Core’s Satoshi Plus consensus architecture, validators earn rewards from two sources: newly minted CORE tokens distributed as base rewards, and fees collected from transactions in each block. Rewards flow proportionally based on a validator’s staked CORE and delegated hash power from Bitcoin miners.
The bug let “malicious validators” pull rewards above that proportional ceiling. Core has not disclosed the total excess issuance, how long the activity ran, or whether any of the surplus tokens entered open circulation. A technical postmortem is promised but not yet published.
The active validator set on Core consists of 21 elected validators per cycle, chosen via a hybrid score that weighs delegated proof-of-work, staked CORE, and staked BTC. Each validator is required to lock up a minimum of 50,000 CORE to participate, per Core DAO’s validator documentation. With a small, known validator set operating in round-robin rotation, the blast radius of the exploit was at least theoretically bounded, even if the full scope remains undisclosed.
The reward mechanism itself, detailed in Core’s validator rewards documentation, is designed so that each active validator receives roughly equal rewards per round. A deviation significant enough to trigger an emergency fork suggests the excess was material, not a rounding artefact.
Exchange Suspensions and What They Signal
Several exchanges moved quickly once the incident surfaced. Coinbase paused CORE sends and receives on the Core network. Bithumb and Coinone suspended deposits and withdrawals, citing suspected or confirmed security concerns. Bitget suspended CORE deposits and withdrawals under wallet maintenance, and LBank suspended deposits citing the project’s own requirements.
The speed and breadth of those suspensions reflects how seriously custodians treat unquantified issuance bugs. When the excess supply figure is unknown, the conservative move is to gate flows until the postmortem clarifies whether inflated tokens reached exchange wallets.
Core has not said whether any of the excess CORE was sold or transferred off-chain by the validators who extracted it. That gap matters: if the tokens entered the market before the fork, they represent dilution that cannot be undone by a forward upgrade alone.
The network’s validator set was already scheduled for expansion. A proposal published in May 2024 called for growing the active set from 21 to 31 validators by Q2 2025. Whether that timeline holds following an emergency fork of this nature remains open.
The postmortem will need to answer three questions the current disclosures leave open: the total excess issued, the specific mechanism validators exploited within the reward calculation, and the disposition of any surplus tokens. Until those are published, the fork closes the exploit vector but leaves the accounting unresolved.
