Decred patches critical flaw that could enable mixing deanonymization attack

cryptonews

Aug 19

Decred has released a mandatory software patch v2.1.6 to fix a critical consensus vulnerability, a potential periodic mixing deanonymization attack, and several network denial-of-service risks. ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers HK | Online Trading in stocks, bonds & ETFS","description":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","keywords":"tiger trading,tiger security,tiger broker hk,tigers co ltd,tiger trade hk,tiger brokers hk,stock broker,securities broker,online brokerage,hong kong broker,hk broker,online stock trading,online trading platform,stock trading platforms,trading application,stock trading,stock trading hong kong,buying stocks in hong kong,tiger brokers","social":{"ogDescription":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://www.gotigerhk.com/news/2660443023"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"HKG","license":"TBHK","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2660443023\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2660443023?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-19 16:27","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2660443023","market":"sh","top_or_hot":-1,"title":"Decred patches critical flaw that could enable mixing deanonymization attack","media":"cryptonews","content":"<div>\n<p>Decred has released a mandatory software patch v2.1.6 to fix a critical consensus vulnerability, a potential periodic mixing deanonymization attack, and several network denial-of-service risks.\n\n\n...</p>\n\n<a href=\"https://crypto.news/decred-patches-critical-flaw-that-could-enable-mixing-deanonymization-attack/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Decred patches critical flaw that could enable mixing deanonymization attack</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nDecred patches critical flaw that could enable mixing deanonymization attack\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-19 16:27 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/decred-patches-critical-flaw-that-could-enable-mixing-deanonymization-attack/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Decred has released a mandatory software patch v2.1.6 to fix a critical consensus vulnerability, a potential periodic mixing deanonymization attack, and several network denial-of-service risks.\n\n\n...</p>\n\n<a href=\"https://crypto.news/decred-patches-critical-flaw-that-could-enable-mixing-deanonymization-attack/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"QQH","symbol_name":"HCM Defender 100 Index ETF","start_time":0,"source_url":"https://crypto.news/decred-patches-critical-flaw-that-could-enable-mixing-deanonymization-attack/","article_id":"2660443023","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/decred-patches-critical-flaw-that-could-enable-mixing-deanonymization-attack/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2660443023","pubTimestamp":1787128061,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Decred has released a mandatory software patch v2.1.6 to fix a critical consensus vulnerability, a potential periodic mixing deanonymization attack, and several network denial-of-service risks.Decred has released mandatory v2.1.6 to fix a critical consensus security vulnerability.The patch prevents a potential periodic deanonymization attack involving Decred’s transaction mixing system.Decred said in an Aug. 19 post on X that users should upgrade to the new release as soon as possible because the patch contains security changes affecting consensus, transaction mixing, and network operations. The project also said the update improves how mixing sessions expire.The release is mandatory because nodes remaining on older software risk being forked from the network. Decred’s release notes said the requirement is especially important for individual stakeholders, Voting Service Providers, proof-of-work miners, and cryptocurrency exchanges running network infrastructure.Users downloading the so","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"QQH":"HCM Defender 100 Index ETF","VGT":"信息技术ETF-Vanguard","BK4588":"碎股","BK4585":"ETF&股票定投概念","IGM":"iShares Expanded Tech Sector ETF"},"translate_title":"Decred修补了可能导致混合去匿名化攻击的关键缺陷","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"VGT":0.65,"QQH":0.65,"IGM":0.65},"content_text":"Decred has released a mandatory software patch v2.1.6 to fix a critical consensus vulnerability, a potential periodic mixing deanonymization attack, and several network denial-of-service risks.\n\n\nSummary\n\n\n\nDecred has released mandatory v2.1.6 to fix a critical consensus security vulnerability.\nThe patch prevents a potential periodic deanonymization attack involving Decred’s transaction mixing system.\nSeveral potential network denial of service attack routes and SPV validation issues have also been addressed.\nUsers running older versions have been urged to upgrade to avoid operating on a different network fork.\n\n\n\nDecred said in an Aug. 19 post on X that users should upgrade to the new release as soon as possible because the patch contains security changes affecting consensus, transaction mixing, and network operations. The project also said the update improves how mixing sessions expire.\n\nA mandatory patch release for Decred is now available with the following changes:– Critical consensus-related security fix– Prevents a potential periodic deanonymization mixing attack– Several fixes for potential network-related denial-of-service (DoS) attacks– Improved…— Decred (DCR) (@decredproject) August 19, 2026\n\nThe release is mandatory because nodes remaining on older software risk being forked from the network. Decred’s release notes said the requirement is especially important for individual stakeholders, Voting Service Providers, proof-of-work miners, and cryptocurrency exchanges running network infrastructure.\nDecred v2.1.6 requires all users to upgrade\nUnder the v2.1.6 release notes, Decred classified the consensus issue as a “critical” security vulnerability and warned that users who fail to update could end up operating on a different network fork. The patch applies to dcrd, Decred’s full-node software, while associated changes have also been released for dcrwallet.\nThe software package contains 23 commits from three contributors, covering 20 files. According to the GitHub release, developers added 795 lines of code and removed 392 lines as part of the patch. Dave Collins, Jamie Holdstock and Josh Rickmar contributed to the dcrd release.\nAlongside the consensus fix, developers addressed several possible network-related denial-of-service attacks. Decred has not disclosed technical details that would provide a step-by-step route for exploiting the consensus vulnerability, while its release notice stresses the need for users across the network to move onto the patched version.\nAt the time of Decred’s X announcement, the Windows build of Decrediton had not yet been made available, with the project saying it expected the release within the following day. The current v2.1.6 GitHub page now lists a Windows version of Decrediton alongside Linux and macOS packages.\nUsers downloading the software can also verify the release files against SHA-256 hashes and associated signature files provided with the package, according to Decred’s installation instructions.\nWallet changes prevent a mixing deanonymization attack\nA separate set of fixes in dcrwallet v2.1.6 deals directly with Decred’s transaction mixing system. The wallet release updates the mixclient protocol to prevent a deanonymization attack and raises the pairing version used to establish compatibility between participants in mixing sessions.\nAs a result of the version change, wallets running v2.1.6 will not mix transactions with older wallets, and older versions will likewise not participate in sessions with updated clients. Decred therefore requires all users of earlier dcrwallet releases to upgrade.\nDevelopers also fixed a problem involving blame assignment during mixing. Under the previous behavior, mixing peers that incorrectly initiated blame assignment could escape being blamed themselves. Another change fixes the removal of messages from the mixpool after a mixing session expires.\nDecred uses CoinShuffle++, or CSPP, for transaction mixing. The project’s documentation describes the system as a way of anonymizing output addresses by combining participants in a mixing process, while handling change separately to reduce links between mixed and unmixed unspent transaction outputs.\nCoinShuffle++ first went live on Decred mainnet in August 2019, according to the project’s historical documentation. Mixed ticket buying can also use the protocol to anonymize outputs from split transactions before they are spent on Decred ticket purchases.\nPrivacy functionality has also kept DCR in discussions surrounding privacy-focused crypto assets. A May 2026 privacy coin ETF analysis from crypto.news noted Decred’s shielded transaction functionality while examining how different privacy-oriented cryptocurrencies could be treated under U.S. regulatory and custody frameworks.\nNetwork and SPV protections receive additional fixes\nBeyond mixing, dcrwallet v2.1.6 changes how the wallet handles transactions received from the network. The updated wallet refuses to record a transaction when signature verification fails for spent outputs belonging to the wallet, according to the release notes.\nSimplified Payment Verification peers face another check under the patch. A peer that announces a transaction containing inputs that appear to spend wallet-owned outputs but fail signature-script verification will now be disconnected. Developers also added missing Merkle-root validation for blocks processed while the wallet operates in SPV mode.\nSPV allows wallets to verify activity without operating in the same manner as a full node, making validation checks an important part of how lightweight clients assess blockchain data. Decred’s project history records its initial dcrwallet SPV implementation in September 2018 and a later consensus change approved in February 2020 that enabled block-header commitments intended to improve SPV wallet security.\nThe combination of the signature, peer-disconnection and Merkle-root changes sits alongside the network-level DoS fixes included in dcrd v2.1.6. Decred’s release notes do not state that the identified attack routes had been exploited in the wild before the patch was published.\nDCR has remained part of the privacy-token market\nDecred’s privacy tools have also influenced how exchanges and traders group DCR with other privacy-focused cryptocurrencies. During a January 2026 privacy token rally, DCR gained about 60% over seven days while Monero, Dash and other privacy-related tokens drew increased demand.\nExchange treatment of such assets has varied. Binance reversed plans in 2023 to remove several privacy-related cryptocurrencies in parts of Europe, leaving Decred, Dash, Zcash, PIVX, Navcoin, Secret and Verge available in France, Italy, Poland and Spain, as detailed in later exchange delisting coverage. Restrictions continued to apply to several other assets.\nOn the software side, Decred’s documentation says mobile wallets do not support privacy mixing or proof-of-stake participation, directing users who want those functions to desktop wallet software. The v2.1.6 release currently provides Decrediton packages for Linux, macOS and Windows, while command-line tools can be installed separately through dcrinstall.\n\n\n\n\n\n                Read more:\n            \n\n                Interlace enters Brazil as stablecoin payment activity grows in Latin America","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}