A vulnerability in Ravencoin's KAWPOW consensus mechanism has been exploited

Ravencoin has released a network announcement revealing that a critical consensus mechanism vulnerability has been demonstrated and exploited on the mainnet starting from block height 4,487,776.

8/12/20265 min read

KAWPOW vulnerability

The core technical cause of the vulnerability on the Ravencoin network – identified by 2Miners in their emergency patch documentation – lies in the block header validation code of the KAWPOW algorithm. The KAWPOW header contains a `nHeight` field but is not matched to the actual position of that block in the chain. By providing a manipulated `nHeight` value, an attacker can trigger a validation process that bypasses the full Proof-of-Work check; the system then accepts the provided `mix hash` value as valid without verifying whether the ProgPoW computation actually took place.

Proof-of-Work (POW) verification is a fundamental security mechanism of blockchains, originating from Bitcoin: it requires block creators to prove they have performed a significant amount of computation, corresponding to the network's difficulty target. This creates an economic cost for creating valid blocks, while also making the cost of generating the majority of the computing power (hash power) needed to impose a fraudulent blockchain extremely expensive. The KAWPOW vulnerability disabled this verification process, allowing attackers to create blocks that appeared valid to nodes that had not updated their software, even though they had not actually performed the computation required by the Proof-of-Work mechanism. Nodes running unpatched software accepted these blocks as valid, added them to the canonical chain as recorded by the system, and continued to create new blocks in succession.

Following the initial exploit, other parties began creating similar invalid blocks, increasing the blockchain's falsification far beyond the scope of the initial attacker's actions. This makes determining the boundary for restoring the network to a "clean" state far more complex than if only one attacker had created a limited set of invalid blocks before the vulnerability was discovered.

The reorganization of the series lasted three days.

Estimates of this three-day chain reorganization reflect the gap between the valid recovery point at block 4,487,775 just before the first invalid block was detected and the block height the network reached when 2Miners and RavenMiner began building the replacement valid chain. The reorganization to block 4,487,775 will reverse any transactions made by Ravencoin users, sellers, and exchanges during the three to four days when the attacked chain was still accepted as official by the nodes.

The practical consequences for all parties involved are severe. Exchanges that processed RVN deposits during the period when the invalid chain existed accepted credits that, after reorganization, would no longer exist on the official chain; this left the exchange holding recorded balances but lacking corresponding confirmation on the new chain. Users who sent RVN to merchant addresses or other wallets during this period saw their transfers reversed: funds returned to their original addresses, while the goods, services, or other assets received in exchange for those funds remained with the counterparty. Withdrawal orders from exchanges processed during this period would also be similarly affected.

Ravencoin has stated clearly: exchanges should not assume that reversed deposits or withdrawals will automatically reappear or be reconfirmed. This recommendation reflects the operational reality that a three-day chain reorganization is not a typical reorganization involving only one or two blocks (which automatically propagate among network members), but rather a deliberate reconstruction of multi-day transaction history; this process requires exchange operators to manually check and compare their internal records with the new state of the official mainchain.

Emergency Patch: 2Miners version 4.6.1.1-hf1

2Miners has released an emergency patch, version 4.6.1.1-hf1, to fix a validation vulnerability in the `nHeight` field. This patch adds a checkpoint at block 4,487,775 to prevent updated software from accepting exploited forks and rejects forged blocks that might bypass the older version's validation process. Ravencoin recommends that all network operators, miners, exchanges, and block explorers immediately upgrade to the patched version.

The checkpoint mechanism integrated into the patch is the technical method 2Miners and RavenMiner use to enforce chain splitting: nodes running the updated software will reject any chain containing blocks from height 4,487,776 onwards belonging to the exploited branch, and consider the recovery chain being built by 2Miners and RavenMiner as the only valid continuation chain from block 4,487,775. For the recovery chain to become official, it needs to accumulate a larger total amount of cumulative proof-of-work than the exploited chain. Since the exploited blocks bypassed the actual proof-of-work calculation process, this goal is entirely achievable for legitimate miners performing valid validation work on the recovery chain.

A suggestion from a Ravencoin community member that mining pools should consider a closer recovery point (with a higher block height) to minimize user impact was rejected. The pools' stance on maintaining the recovery point at block 4,487,775 instead of a closer point reflects the technical understanding that any recovery point within the mining range would leave a history of faulty validation on the canonical chain, while a full reorg from block 4,487,775 would create a "clean" chain, albeit at the cost of reversing transactions for three to four days.

Assessment and Conclusion

Upbit has flagged RVN as an asset requiring attention (a warning) for KRW, BTC, and USDT trading pairs, and temporarily suspended deposit services due to network issues. Upbit had previously listed the RVN/KRW trading pair in June 2025. Bitvavo also temporarily suspended RVN deposits and withdrawals as a precautionary measure due to a serious vulnerability in the consensus mechanism. Similarly, Bitget also suspended RVN deposit and withdrawal transactions. This coordinated move by exchanges reflects the recommendation of the Ravencoin project, which requested exchanges to temporarily halt all RVN transfers until network issues are resolved and blockchain stability is restored.

Users storing RVN in self-managed wallets are advised to consider any transaction confirmations received after block 4,487,775 as potentially subject to rollback; the official blockchain status will only be definitively established when the recovery chain prevails and the network is stable. The Ravencoin project explicitly states that their announcement should not be interpreted as an endorsement of any particular option regarding transaction rollback, chain selection, or recovery plan; instead, the final decision will rest with miners and network node operators through a competition for computing power (hash-rate) between the recovery chain and the attacked chain.

Disclaimer: The content in this article is for informational, research, data analysis, and reference purposes only regarding the cryptocurrency market. All opinions, assessments, forecasts, or opinions reflect the author's perspective at the time of publication and do not constitute investment advice, solicitations for buying or selling, trading recommendations, advertising, marketing, or promotion of any financial products, services, or cryptocurrencies. Mentions of projects, tokens, protocols, exchanges, wallets, or cryptocurrency service providers (CASPs) are for research, analysis, or informational purposes only and should not be construed as endorsements, recommendations, or guarantees in any way. HCCVenture does not broker, advertise, market, promote, or connect users in Vietnam with any cryptocurrency services from CASPs. HCCVenture does not accept asset custody, investment mandates, manage assets, or execute transactions on behalf of clients. All investment decisions are made entirely through the reader's own research (DYOR), evaluation, and responsibility; HCCVenture is not liable for any losses or damages arising from the use of or reliance on the information presented in this article.

Compiled and analyzed by HCCVenture

Join our information channels: https://link3.to/holdcoincventure

Explore HCCVenture group

Connect with us

Disclaimer: The information on this website is for informational purposes only and should not be considered investment advice. We are not responsible for any risks or losses arising from investment decisions based on the content here.

TERMS AND CONDITIONS • CUSTOMER PROTECTION POLICY

ANALYTICAL AND NEWS CONTENT IS COMPILED AND PROVIDED BY EXPERTS IN THE FIELD OF DIGITAL FINANCE AND BLOCKCHAIN BELONGING TO HCCVENTURE ORGANIZATION, INCLUDING OWNERSHIP OF THE CONTENT.

RESPONSIBLE FOR MANAGING ALL CONTENT AND ANALYSIS: HCCVENTURE FOUNDER - TRUONG MINH HUY

Read warnings about scams and phishing emails — REPORT A PROBLEM WITH OUR SITE.