Ray

Hello Andrew. We need to upgrade C******* to extend its learning and enable it to adapt in quasi real time. Our infrastructure have to survive thousands of attacks per seconds, enabling it to resist the attacks and adapt to it is the main challenge we will have to address in the coming days (not even weeks). AI is definitely a cybersecurity Pandora box a nightmare for the makers community.

Short answer we don't know. As of today we have no definitive answer. If ever something like what happened to @binance @cz_binance happened to us, we wouldn't be able to address the problem as the Binance business team did. we are not there yet. It tooks @binance over a decade to reach that level or corporate resilience.

The worst might be seen by January/February 2027.

We got this. The tool was already prepared. we didn't anticipate the scale. this hour report: [C***** r14-rpc-activity/L2] RPC activity report (24h) - 297 malicious / 7482 unique IPs

@12gauge000, we won’t go anywhere. We’re different because we’re driven by conviction, guided by principles, and committed to a purpose greater than ourselves. Fear nothing but the fear itself.

A security incident, how we contained it, and why your funds were never on a bridge On 31 October 2026 the Datachain Foundation infrastructure was targeted in a credential-theft intrusion. We want to be transparent about what happened, what we did, and one deliberate decision from months ago that kept user funds out of the blast radius. What the attack was This was not a smart-contract exploit. It was an identity attack. The intruder had earlier harvested server access material and mapped our estate with fast enumeration tooling: a DNS and asset-discovery scanner, and an RPC probing script that walked internal nodes looking for dangerous, unauthenticated methods. With a stolen operator key, they logged into several Foundation servers, where an implant had been quietly sitting since October 16. Using signer keys they found on those hosts, they tried to move value in three ways: editing a reserve balance directly, replaying forged mint calls against the legacy-migration minter, and minting internal stablecoin test units on the exchange to drain liquidity pools into a single collection wallet. That wallet has never sent a transaction, which is how we know nothing left it. How we contained it We rotated every SSH key across the fleet, verifying each new key before removing the old one so no one was ever locked out. The implant was killed and quarantined on every affected host. We installed a write filter in front of the block producer that rejects the attacker addresses and the stolen signer keys, and we paused the migration minter and both bridge contracts. Native FAT was recovered on-chain through a transparent, auditable sequence that every node applied identically. We then rebuilt our AI augmented security system, C*****, to pin the attacker IPs, detect secret sprawl automatically every six hours, and run the attacker's own enumeration methods inward against ourselves on a schedule so we find a weak endpoint before an outsider does. What was and was not affected - Your wallet: Datachain wallets are non-custodial. The Foundation never held your private keys or seed phrases, and nothing in this intrusion gave the attacker access to them. - Bridges: none were live, so no cross-chain deposits were exposed (see below). - DCSwap liquidity pools: pools were restored to their pre-incident state / the forged test units were neutralised at knot height X. - DC FAT: the units moved by the attacker were recovered on-chain as described above, and the collection wallet never sent a transaction. - Personal data: [confirm whether any user data was stored on, or accessed from, the compromised servers]. Why your funds were never on a bridge Here is the part worth sitting with. We have already completed most of the bridging work on Arbitrum (100%), Ethereum (+80%), XDC (+80%), and Solana (+80%) bridges. We did not ship any of them to production. They sat paused behind an audit gate while we ran the industry-standard soak period, roughly a 120-day pain test, before we would ever hold user funds on a cross-chain rail. Because of that discipline, even though the intruder reached signer keys, there was no live bridge holding community deposits to drain. The cross-chain attack surface that has cost other projects hundreds of millions simply did not exist yet on our side. We were, frankly, fortunate that caution and a slow, boring release schedule met us at exactly the moment it mattered. What you should do No action is required to protect your funds. [Confirm.] Incidents like this one are routinely followed by impersonation attempts, so please stay alert: - The Datachain Foundation will never ask for your seed phrase or private key, and will never ask you to "re-validate", "migrate" or "reconnect" your wallet. - We will not announce any compensation, airdrop or token swap related to this incident through direct messages. - Use only our official addresses: datachain.one, DCSwap.net and dcscan.io. - If anything looks suspicious, write to [email protected] before you act like @sawyerx589, marc willson, and @Ray_D21 did. What this changes We are treating this as a reminder, not a reassurance. Key custody is moving further off always-on servers, secrets are scanned continuously, and bridges stay paused until they clear both an external audit and the full soak window. We will keep publishing what we find. A detailed technical post-mortem, including the on-chain recovery transactions, will follow (date / location to confirm). Thank you for your trust. We do not take it lightly. Support all our efforts by participating to the 200% bonus campaign. We are facing the same challenge faced by big players like Binance, JP Morgan, but we have none of their financial resources. We rely on the community and our clients. I you can afford supporting us, contact the OTC Desk: datachain.one/otc-request Thank you for your support Datachain Foundation Cybersecurity team

SECURITY ALERT / DEFCON 3 We have been hacked. We are treating this as an internal DEFCON 3 security incident. Protecting our community and securing our systems are our immediate priorities. We will keep you updated as facts are confirmed, including the scope of the incident, its impact, and any actions you may need to take. Please remain vigilant against impersonation attempts and unsolicited messages. Never share your passwords, private keys, or recovery phrases. Thank you for your patience and vigilance. Further updates will follow.