Ethereum Classic node operators have been urged to avoid a disputed Core Geth v1.13.0 release after several mining pool nodes briefly adopted the software before returning to the maintained Argos client.
Classix said in a Sept. 16 incident report that the ethereumclassic/core-geth repository released v1.13.0 on Sept. 14 before the @$ETC_Network account promoted it as an Ethereum Classic security update and told node operators to migrate. Similar messaging appeared on CoinMarketCap, while mining pools received emails from an ethereumclassic.com address.
The report described the release as a rogue version because the existing Core Geth maintainers had not reviewed it and the maintained etclabscore/core-geth repository had not issued the update. Classix recommended that operators continue using Argos v1.12.23, the current release from the repository that has maintained Core Geth since 2020.
Rogue Core Geth release reached some $ETC mining nodes
Development of the disputed version accelerated during the days before its release. According to Classix, 96 commits containing 13,422 added lines and 3,977 deleted lines were pushed within 56 hours directly to the fork’s main branch without pull requests or outside review.
The ethereumclassic/core-geth repository itself had been forked from etclabscore/core-geth in December 2024. Activity increased on Sept. 12, 2026, when v1.13.0-rc1 was tagged. Six more release candidates followed before v1.13.0 was labeled stable at 15:06 UTC on Sept. 14. The @$ETC_Network account published the migration request the following morning.
The software reached part of Ethereum Classic’s mining infrastructure before operators reversed the migration. Four 2Miners nodes were running CoreGeth v1.13.0 at 12:09 UTC on Sept. 15, according to node status data cited by Classix. By 23:35 UTC, all four had returned to Argos v1.12.23. Other listed mining pools remained on versions in the 1.12 series.
Some individual nodes continued running the disputed software. Etcnodes.org showed 11 v1.13.0 nodes at 07:33 UTC on Sept. 15, with the number falling to 10 by Sept. 16. Three of the remaining nodes matched bootnode IP addresses hardcoded into the new client, according to the report.
No blocks were lost, no chain reorganizations occurred, no funds were affected and no service interruption was recorded during the incident, Classix said. The report classified the event as high severity but low impact because the software altered consensus behavior while producing no recorded economic or transaction losses.
Ethereum Classic has faced chain reorganizations before. As crypto.news previously reported in its coverage of Ethereum Classic majority attacks, $ETC suffered three majority attacks in August 2020, including reorganizations involving thousands of blocks.
Classix disputes v1.13.0 security claims
The v1.13.0 release told operators that every node running v1.12.x should upgrade and claimed each release in that series contained unpatched security issues, including a vulnerability allegedly used against Ethereum Classic bootnodes in March.
Classix challenged that description after reviewing seven security issues cited by the release. Five had already been addressed in maintained Core Geth releases between March and August, while the other two did not affect Ethereum Classic’s peer to peer path, according to the report.
CVE-2026-22862 and CVE-2026-26315 were among the vulnerabilities Classix said had been fixed in Aegis v1.12.21. Hermes v1.12.22 subsequently addressed other cryptographic issues, while Argos v1.12.23 incorporated delayed peer to peer message decoding from go-ethereum to address CVE-2026-26313.
Another listed issue, CVE-2026-22868, concerned KZG proof verification. Classix said it did not apply to Ethereum Classic because KZG proofs are associated with blob transactions introduced through Ethereum’s Cancun upgrade, which $ETC has not activated. The report said a separate GraphQL query depth issue was not part of the peer to peer or consensus path and required GraphQL to be enabled manually.
Classix said Core Geth maintainer Diego López León reviewed the remaining differences and found no exploitable flaw in Argos that v1.13.0 corrected.
Core Geth changes included MESS and new bootnodes
Beyond its security claims, v1.13.0 changed how participating nodes could select chains and discover peers.
One modification reenabled Modified Exponential Subjective Scoring, or MESS, by removing the configuration that deactivated it at block 19,250,000. Ethereum Classic introduced MESS in 2020 as protection against chain reorganizations before disabling it through ECIP-1110 after Ethereum moved from proof of work to proof of stake.
Classix warned that different consensus clients could behave differently if only Core Geth nodes used MESS. Besu, Nethermind and Getc do not implement the mechanism, according to the report.
Historical reorganizations remain a particularly relevant issue for $ETC. A crypto.news review of blockchain reorganization history described how miner consensus and competing chain histories can determine the outcome of reorganizations on proof of work networks.
The disputed client changed node discovery infrastructure as well. A commit replaced a DNS tree signing key maintained by etclabscore contributors since 2020 and hardcoded three new bootnode IP addresses. Two older discovery trees, blockd.info and etcdisco.net, were subsequently removed.
Three replacement domains were hosted through the same Cloudflare account, according to the report, while the repository acknowledged that an issue affecting the single account could remove all three paths. Operators following the migration instructions were not told who controlled the new signing key, Classix said.
The migration guide separately instructed operators to rotate their P2P node keys, citing CVE-2026-26315. Classix said Aegis had already fixed the underlying issue in March. Rotating a key changes a node’s network identity and forces it to rebuild peer connections through discovery infrastructure.
Ethereum Classic operators urged to return to Argos
Classix recommended that operators avoid ethereumclassic/core-geth v1.13.0 and continue running etclabscore/core-geth Argos v1.12.23. Operators that had already migrated were told to move back, restore their previous node key if it had been rotated and check their MESS configuration.
The report said Ethereum Classic operators should consider running different clients instead of concentrating network hash power on Core Geth. Nethermind, Besu and Getc remain available alternatives.
Client diversity has become a recurring security consideration across blockchain networks. Ethereum development, for example, continues to test upgrades across multiple execution and consensus implementations before deployment. Recent Glamsterdam testnet preparations included another private devnet after testing exposed consensus and execution implementation bugs ahead of the planned Sepolia activation.
Classix asked administrators of the ethereumclassic GitHub organization to tighten repository controls, require proposals and reviews before new repositories are created, protect default branches and identify maintainers for repositories distributing software. It separately requested that ethereumclassic/core-geth be removed or archived, or carry a warning explaining that it is not an official client.
Ethereum Classic itself does not designate an official developer, maintainer, website or client, according to the project’s website disclaimer quoted in the report. Classix said the maintained etclabscore repository derives its standing instead from its six year public history, active maintenance and adoption among $ETC nodes.
The report is intended to serve as both an initial notification and an interim incident report. Classix said it would update the document if the remaining nodes are verified, organization maintainers respond or other material developments emerge.
