MultiversX hit by Upbit warning after mainnet exploit

MultiversX exploit triggered the Upbit warning

The warning follows a confirmed attempt to exploit a virtual-machine-level atomicity issue on the MultiversX mainnet.

MultiversX initially disclosed on Sept. 19 that it was investigating a potential mainnet issue and prioritizing user safety and stable network operation. As crypto.news previously reported, the project’s first statement did not classify the event as an exploit or disclose any confirmed financial loss.

A later project update said an actor had “attempted to exploit a VM-level atomicity issue.” The attempt produced invalid state changes, prompting developers to stop network progression while engineers worked on a repair.

The team prepared a software fix for testing through a shadow fork, allowing developers to reproduce mainnet conditions without immediately applying changes to the live network.

MultiversX said deployment would proceed “subject to successful testing” and would require coordination with validators, exchanges and infrastructure providers. No firm restart deadline appeared in the public updates reviewed.

Security tracker SlowMist separately recorded the incident as an attempted VM-level atomicity exploit involving invalid on-chain state changes. Its public database did not list a confirmed loss amount.

$EGLD withdrawals remain blocked across exchanges

Upbit’s action came as several exchanges restricted MultiversX transfers following the network disruption.

Bithumb suspended $EGLD deposits and withdrawals on Sept. 19 after MultiversX block production stopped. The exchange said transfer services would remain unavailable until it confirmed network stability.

Bithumb had restored $EGLD deposits and withdrawals only three days earlier following a scheduled network upgrade, according to its Sept. 16 service notice.

Kraken took a different approach. Its public status page placed $EGLD trading pairs into cancel-only mode, allowing users to cancel existing orders while preventing new trades. Deposits and withdrawals remained unavailable.

Coinbase separately reported delayed $EGLD sends and receives beginning Sept. 19 because of a MultiversX network issue. Buying, selling and fiat services were not affected by the transfer disruption.

MultiversX told users not to submit or rebroadcast transactions and advised against moving $EGLD or ESDT tokens through exchange deposit and withdrawal routes or cross-chain bridges until the project issues an all-clear.

Upbit can extend the warning or end $EGLD trading

The Upbit designation does not immediately remove $EGLD from the exchange.

Under its digital asset trading-support termination policy, Upbit will review whether the reasons behind the caution notice have been fully resolved before deciding whether to lift the warning, extend the review or end trading support.

The current review period runs from Sept. 21 through the fourth week of October, with Upbit identifying Oct. 19-23 as the expected decision window.

The exchange said the review can be extended if further investigation is required. A failure to fully resolve the underlying security concerns could lead to termination of $EGLD trading support.

Deposits made after publication of the caution notice cannot be credited normally and fall under Upbit’s return process. Since transfer services were already suspended, users remain unable to use standard $EGLD deposits or withdrawals.

Upbit cited Article 17(1)(e) of South Korea’s Virtual Asset User Protection Act Enforcement Decree when explaining the designation.

The exchange said its decision considered whether a security incident affecting a wallet, distributed ledger or other infrastructure used to issue, transfer or store virtual assets remained unexplained or unresolved.

$EGLD weakened as network restrictions spread

$EGLD declined while the network issue and exchange restrictions developed.

CoinGecko historical data show $EGLD closing at $4.14 on Sept. 18, before falling to $3.87 on Sept. 19 and $3.78 on Sept. 20. The move represented a decline of roughly 8.7% from the Sept. 18 close.

Trading activity increased during the disruption. CoinGecko recorded approximately $10.18 million in $EGLD volume on Sept. 20, compared with roughly $3.35 million on Sept. 18.

The timing places the price decline alongside the security incident and exchange restrictions, though the market data alone do not establish that the exploit attempt caused every part of the move.

The episode came shortly after MultiversX activated its Supernova mainnet upgrade, which reduced targeted block time from six seconds to 600 milliseconds and shortened cross-shard settlement.

No MultiversX statement reviewed has connected the VM-level atomicity exploit attempt to Supernova, so the upgrade and security incident should not be treated as causally linked without further technical evidence.

MultiversX plans recovery before releasing full report

MultiversX said engineers were evaluating a targeted recovery procedure designed to preserve finalized legitimate transaction history while correcting invalid state changes linked to the incident.

The project has not yet published the exact recovery method or identified which transactions, smart contracts or account states require correction.

Its official status page has shown several services, including the Public API, xPortal, Explorer, Wallet, Bridge and xExchange, as experiencing degraded performance during the incident response.

Gateway and Index services were listed as operational in the same status update. MultiversX said a full technical incident report would be published after investigators finish the response and finalize their findings. Upbit, Kraken and other exchanges are meanwhile keeping $EGLD transfer restrictions in place pending further network recovery updates.