Cardano In Crisis Mode: Hoskinson Breaks Down The Poison Piggy Attack
Cardano has simply come by one of the crucial extreme technical incidents in its historical past – a 14-hour chain break up that founder Charles Hoskinson insists was “severe, however not existential.” In a late-November livestream, he walked viewers by Pi Lanningham’s “Poison Piggy – After Action Report,” an in depth autopsy on what occurred on November 21, 2025, and what it means for Cardano’s long-held “no downtime” narrative.
Inside Cardano’s 14-Hour Pig-Chain Meltdown
According to Lanningham, a serialization bug in Cardano’s node implementation created the situations for a unidirectional delicate fork. The challenge first surfaced on November 20 on the preview testnet, when a malformed delegation certificates was accepted by some nodes and rejected by others. Older nodes appropriately rejected the over-long hash; newer nodes, as a result of a November 2024 code change, truncated it and handled it as legitimate. That model skew created two incompatible views of the chain.
“The entire cause the testnet exists is to be a secure house” to search out these failures, Hoskinson famous. Under regular circumstances, the bug would have been patched and quietly rolled out. Instead, after the repair was recognized and was within the strategy of being communicated to stake pool operators, a near-identical malformed delegation was submitted to mainnet, this time delegating to RATSRATS – conceptually doubling the ticker of RATS, Hoskinson’s personal stake pool.
That transaction break up Cardano mainnet into two forks. The stricter fork, working older code that rejected the malformed hash, grew to become the “hen chain.” The permissive fork that accepted it was christened the “pig chain” or “poison piggy.” From that time, the community entered a race: would the poisoned transaction on the pig chain grow to be immutable earlier than the hen chain might overtake it?
On influence, Lanningham’s numbers are blunt. Cardano remained dwell however degraded. Transaction inclusion through strong infrastructure slowed dramatically, with delays of as much as roughly 400 seconds and block instances on the now-dominant chain stretching to round 16 minutes at their worst. Over the incident window, 846 blocks had been produced on the pig chain and round 13,900 on the hen chain. Out of 14,383 noticed transactions, 479 – roughly 3.3 % – had been included solely on the discarded pig chain and by no means appeared on the ultimate canonical historical past. Most of these, when resubmitted, turned out to be invalid as a result of expired validity intervals or conflicting inputs.
“This constitutes a severe degradation of service for customers, however inside anticipated bounds for a high-nines availability of service,” Lanningham wrote. His bottom-line guidelines is terse: “Did the chain proceed to make progress? Yes. Was service degraded? Yes. Were funds in danger? Potentially. Did the Cardano community get better beneath primarily worst case situations? Yes. Would I’ve confidence to construct my enterprise on high of infrastructure that exhibited this degree of robustness? Yes.”
The restoration itself is being held up by Hoskinson as proof of each decentralization and design. A patched node was already out there because of the testnet incident; in a single day, IOG, the Cardano Foundation, Emurgo, Intersect, exchanges and lots of SPOs coordinated through war-room calls and chat channels to improve to the fastened model and to observe the extra restrictive hen chain. There was no protocol-level rollback and no centralized “restart.” As stake migrated, block manufacturing on the pig chain slowed, the hen chain accelerated, and Ouroboros’ probabilistic finality properties ensured that after the wholesome fork overtook the poisoned one, nodes on the pig chain mechanically switched to the longer, denser chain.
“This is the concrete proof of when the Nakamoto consensus labored as meant and converged the community to a single canonical historical past,” Lanningham argued. Hoskinson went additional, saying, “This might have killed different chains,” however right here “time works in a different way in a distributed system” and successfully stretched the rollback window in Cardano’s favor.
Lessons Learned
Both, nevertheless, are clear in regards to the draw back. “The reality the bug appeared in any respect is a failure of our testing rigor,” Lanningham conceded. The reliance of just about all explorers on cardano-db-sync left the ecosystem “flying blind” when that element crashed on the malformed transaction. Many SPOs seemingly upgraded “blind,” trusting suggestions from founding entities fairly than reasoning independently about fork selection. And sure off-chain techniques – particularly exchanges and bridges – had been uncovered to replay and double-spend danger, even when early proof suggests actual losses are unlikely.
The autopsy thus doubles as a roadmap. Lanningham requires stronger fuzzing and spec-driven testing, richer node-to-client protocols so wallets and exchanges can implement circuit breakers based mostly on actual consensus well being, extra range in monitoring stacks, and higher schooling for SPOs on how Ouroboros behaves beneath stress. Hoskinson, for his half, floated the concept of an AI “improve sentinel” for operators and revived calls for for a built-in pub/sub channel for emergency alerts.
For the broader narrative conflict, Lanningham’s place is intentionally dispassionate: “If, after that, you resolve for your self that Cardano ‘went down’, I received’t begrudge you your opinion. I’m not valuable about that label… What issues is influence.” Hoskinson is much less diplomatic, dismissing most social-media commentary as noise. What he needs the trade to remove is less complicated: on November 24, 2025, after Poison Piggy, Cardano is again to at least one chain – and its subsequent iteration of hardening has already begun.
At press time, ADA traded at $0.4141.
