The vulnerability in ixofoundation’s Blockchain allowed funds to be moved from any address resolved via a DID verification method without verifying that the signer of the transaction owned that address. Because any account can list an arbitrary blockchainAccountID on a DID it controls, an attacker could register a victim’s address as a verification method on the attacker's own DID and reassign the victim’s balance to a bond controlled by the attacker. The attacker could then withdraw and bridge the proceeds off‑chain. This transferred token balances without requiring victim keys, signatures or any system compromise, representing a catastrophic loss of value. The weakness is an authorization failure (CWE‑285) and missing authorization (CWE‑862) in the chain’s state‑machine logic.

ixofoundation ixo-blockchain, all releases prior to the 8.0.0 binary, including the 7.x series and the ixo-5 mainnet. The flaw impacted handlers such as MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, MsgWithdrawShare, and the batch order processor, as well as any bonds-related route (top‑level, authz, CosmWasm, ICA).

The CVSS score of 9.3 marks this an extremely severe vulnerability. The EPSS score is not reported, but the attack requires only a valid on‑chain transaction and no victim signing material, making exploitation highly feasible for anyone with an account on the chain. It was already exploited on ixo mainnet on 2026‑06‑20, confirming real‑world impact. The vulnerability is not currently listed in the CISA KEV catalog. The vulnerability can be exploited by simply issuing a bonds message; the chain will move the victim’s funds without authorization, so the attack vector is purely on‑chain transaction submission. The fast propagation of the attack led to significant fund losses, and the only remediation is to run the patched binary, as there is no application‑level workaround.