Security Incident: Forged Claims on Nexus Miner Rewards
On November 1, forged claims took 14,174.77 ADA from our Nexus miner rewards wallet. Here is what happened, what we have done and what miners should know.
On November 1, 2026, an attacker took 14,174.77 ADA, worth about US$2,740 at that day's price, from the wallet that pays Nexus Miner rewards. They did it by exploiting a vulnerability in our claim architecture.
Here is what happened and what we have done so far.
What happened
All times are UTC on November 1 unless noted. Every transaction below is public, so you can trace the funds yourself on Cardanoscan.
- 10:38: Scripted requests began probing our claims API.
- 11:38 to 12:22: 114 forged claims were paid from the rewards wallet, totaling 14,174.77 ADA. The first forged claim paid 2,092.01 ADA.
- 12:35 to 12:42: The attacker swept the funds into a single address, in a first sweep and a second sweep.
- 13:22: 14,174 ADA moved to another address.
- 22:50: That ADA split between two high-volume addresses, where it mixed with other funds.
- November 2, 00:11: We shut off the claim routes on the live site and confirmed they were off.
Nexus Miners
- Wallets were not touched and no keys were compromised. The ADA came from our rewards wallet, not from miner wallets.
- Rewards may erroneously show as claimed. We have the on-chain and database records that identify the 114 affected stake keys and are reconciling the books.
- Claims are temporarily paused while we patch this hole and harden systems.
If feasible, we will replace some or all of the stolen funds out of pocket, though we ask patience while we analyze our reward systems and potentially redeploy an entirely new reward system design.
Please watch for scams. Nobody from Ultra Labs will ask for your seed phrase, ask you to connect your wallet to a "recovery" site or ask you to send ADA to get ADA back. Any updates will come through this blog and our Discord.
How it worked
A Cardano address has two parts: a payment key, which controls spending, and a stake key. Stake keys are public, and anyone can build an address that combines their own payment key with someone else's stake key.
Our claim system checked that a payout address contained the stake key registered to a miner. It did not check that the person claiming actually controlled that stake key. The attacker built addresses using their own payment key and each miner's stake key. Our system accepted them as valid and co-signed the payouts.
What we have done
- Shut off the claim and payout routes
- Traced the funds on-chain and preserved our server logs
- Privately notified other Cardano projects that may run similar claim systems, so they could check their own
- Moved the remaining funds to a new wallet: addr1q90uguq4enh5zqgenru8vnlk0au78l7xwzdm7z76ex7mal75wkde8pm5xd87sl7222vvx7tp82wtfr08wy6kdejm668swu68jx
- Identified all addresses involved and are reporting to authorities
What happens next
Claims have been turned off until we have thoroughly reviewed our systems and completed a comprehensive security update. We are deploying the best tools available to update and harden our systems and possibly redesign our on-chain rewards design from the ground-up.
If you run a claim system on Cardano
Check how your system proves that a claimant controls a stake key. An address that contains the right stake key does not prove it, and neither does a signature from the payment key. If your system pays out on either basis, pause it and review it. If you would like to compare notes, please reach out to us directly.
Ironically, just days earlier we wrote about the suspected Binance hack. Attacks like these hit projects of every size, including ours.
Figures come from on-chain records and our own logs as of November 2, 2026, and may be updated as the investigation continues.