Succinct advised users running native Rust verifiers in SP1 who accept proofs from untrusted provers to upgrade their software to version 6.8.1

Overview Debates Related claims Topics Sources

The SP1 soundness flaw affected native Rust verification in sp1_hypercube, sp1_prover, and sp1_sdk versions 6.0.0 through 6.8.0

A high-severity soundness bug in Succinct's SP1 zero-knowledge proving system exposed Succinct's mainnet Prover Network to invalid execution proofs from third-party provers

On-chain Solidity verifiers for Groth16 and Plonk checks and applications whose proof aggregation ended in Groth16 or Plonk proofs were unaffected by SP1's high-severity soundness bug

Security firm Blockaid warned that the X100 governance takeover attack launched on October 24, 2026 on the Ethereum network was ongoing

The X100 protocol governance takeover attack on October 24, 2026 targeted assets held on the Ethereum blockchain, liquidating liquidity pools and treasury reserves

Succinct deployed the version 6.8.1 patch for SP1's soundness bug to the mainnet Prover Network, requiring no configuration changes from users requesting network proofs

An attacker could exploit SP1 by supplying proof data with mismatched size labels, causing the native Rust verifier to accept an invalid proof

Succinct stated in GitHub security advisory GHSA-p7v2-jjv3-8p8f that its mainnet Prover Network was the only known deployment affected by a high-severity soundness bug in SP1's proving system

Groth16 and Plonk proof checks in SP1 remained safe because they used wrapped proofs with fixed shapes that bypassed prover-controlled tensor formats

SP1 stores multidimensional data in Tensors, where SP1's native Rust verifier failed to check whether the number of stored elements matched the product of the tensor's declared dimensions

Succinct released version 6.8.1, which patched a high-severity soundness bug in SP1, on September 24, 2026, 17 days before publishing GitHub security advisory GHSA-p7v2-jjv3-8p8f on October 11, 2026

The conversion of stolen USDT into ether following the X100 exploit was carried out shortly after the X100 protocol treasury tokens were drained on October 24, 2026

The X100 protocol exploit on October 24, 2026 was executed in two transactions that converted X100 protocol treasury tokens and liquidity positions into USDT

Blockchain security firm Blockaid reported that malicious activity targeting the X100 protocol continued following the initial treasury drain on October 24, 2026

The primary exploiter in the X100 protocol governance takeover attack on October 24, 2026 converted approximately 4.75 million USDT into ether

The proceeds from the X100 protocol exploit on October 24, 2026 were split across four wallets, with a distribution wallet retaining an additional 423 ETH

After swapping USDT into ether, the X100 attacker in the October 24, 2026 governance takeover initiated wallet transfers to disperse the stolen funds across multiple Ethereum addresses

Hardware wallet manufacturer Trezor disclosed a customer data breach in August 2026 caused by unauthorized access at its third-party logistics provider, ShipMonk

Following the unauthorized access to its website on October 20, 2026, Keystone Hardware Wallet blocked unauthorized access, patched the website vulnerability, and began notifying customers affected by the breach via email

Keystone Hardware Wallet confirmed on October 23, 2026, after reviewing API activity with Shopify, that a third party had obtained customer data