TLDR
- Monero experienced an 18-block reorganization attack that reversed 117 transactions on Sunday
- XMR price rallied 7.4% from $287 to $308 just hours after the security breach
- Qubic mining pool executed the attack using 51% hashrate control over Monero network
- The reorg exceeded Monero’s 10-block protection mechanism and raised double-spending concerns
- Community considers DNS checkpoints as temporary fix despite centralization trade-offs
Monero’s XMR token posted a surprising 7.4% price gain on Sunday despite suffering the largest blockchain reorganization attack in the network’s history. The privacy cryptocurrency climbed from $287.54 to $308.55 within hours of a major security breach that reversed 117 confirmed transactions.
The 18-block reorganization began at block 3499659 at 5:12 AM UTC and lasted approximately 43 minutes. The attack was executed by the Qubic team, which controls over 51% of Monero’s mining hashrate. Cryptocurrency protocol researcher Rucknium confirmed the security incident on GitHub, while node operators shared evidence of the attack on social platforms.
The price rally occurred while broader cryptocurrency markets declined by 1%, making Monero’s performance even more unusual. Crypto podcaster xenu, who first reported the reorganization, suggested Qubic may have been attempting to prevent further XMR price drops through the attack.
51% Attack Raises Double-Spend Concerns for XMR Users
The 18-block reorganization exceeded Monero’s built-in 10-block protection mechanism designed to safeguard against smaller reorgs. Security experts noted that reorganizations of this magnitude typically indicate deliberate interference or extreme mining power concentration.
Blockchain specialists warned the incident creates conditions for potential double-spend attacks. In such scenarios, attackers could invalidate previously confirmed transactions by creating deeper blockchain versions that exclude specific payments.
Monero transactions were traditionally considered secure after 10 confirmations. However, analysts now question whether this threshold provides sufficient protection against large-scale reorganization attacks. The incident has prompted some community members to lose confidence in network reliability.
In August 2025, Qubic’s majority hashrate control previously triggered concerns, leading exchanges like Kraken to temporarily suspend XMR deposits. Blockchain data shows large pools including monero.hashvault.pro and supportxmr.com competing to produce valid chains while smaller pools’ blocks are frequently discarded.
DNS Checkpoints Proposed as Temporary Solution
Rucknium stated it is “highly likely” that Monero node operators will implement Domain Name System checkpoints to prevent future reorganizations. This solution involves nodes fetching trusted block data from community DNS servers.
However, DNS checkpoints would increase network centralization, which critics argue has already been compromised by Qubic’s dominant mining position. SlowMist founder Yu Xian warned that failure to address reorganization issues would leave Monero perpetually vulnerable to attacks.
The Monero community has previously explored various solutions including localizing mining hardware, implementing merge mining algorithms compatible with Bitcoin, and adopting Dash’s ChainLocks technology. Despite these discussions, no effective solution has been implemented to reduce Qubic’s network influence.
