QoreChain Opens Public Bug Bounty 11 Days After an Exploit in Its Own Code

The chain was halted in 25 minutes, state restored, no user lost funds. The bounty pool is an on-chain address anyone can query.

ROLLE, VAUD, SWITZERLAND, September 2, 2026 /EINPresswire.com/ -- On August 21, 2026, an authorisation failure in the SVM execution lane of QoreChain, a quantum-safe Layer 1 blockchain, allowed a single transaction to move most of the network's token supply. The QoreChain Association halted block production 25 minutes after the transaction, restored chain state to the block preceding it, and restarted the network. No user lost funds. Three days later the Association published the complete technical report, including the code path, the timeline, and the reasons the response took 25 minutes rather than five.

On September 1 the Association opened a public bug bounty over the same network.

The programme, Break QoreChain, runs as a defined season from September 1, 2026 to February 28, 2027. Its reward allocation is held in a dedicated on-chain escrow at qor1c60gmsq68jpx8yzjj0pagl7kkggs4zc8mrfkkm, which holds 67,500,000 QOR and can be queried from any public endpoint of the network without contacting the Association. The first season is funded from the tranche released at listing, 10,125,000 QOR, which is distributed in full at settlement whether or not a critical vulnerability is found.

Individual rewards are fixed and denominated in stablecoin rather than in the project's own token: 5,000 USDT for a critical finding, 2,000 for high, 750 for medium, 250 for low and 100 for an insight. Part of each award is paid within fourteen days of the report arriving for critical and high severities, and twenty one days for the rest. The remainder is paid when the fix reaches mainnet, or at ninety days from the triage decision, whichever comes first, so that a researcher's payment does not depend on the Association's engineering schedule.

Scope at opening covers consensus and block production, the bank module and escrow accounting, the ML-DSA-87 post-quantum signing path and key registration, the EVM execution lane, public RPC and API infrastructure, and the QoreX wallet. Components under active remediation are deliberately excluded and are added, each with an announcement, as their remediation completes. The SVM execution lane, the component involved in the August 21 incident, enters scope in the final two weeks of the season following an external audit, before it is reopened to users.

Every valid report is published after the corresponding fix is deployed, with credit to the researcher unless anonymity is preferred. Reports received before the programme opened are covered at full programme rates, and several arrived in the days before opening.

"An incident report is a document. A bug bounty is a standing invitation, and the difference matters," said Liviu Ionut Epure, Founder and Chief Technology Officer of the QoreChain Association. "Eleven days ago a flaw in code we are responsible for did what we are now paying people to attempt. We halted the chain, restored state, nobody lost funds, and we published all of it including the parts that did not flatter us. The failure mode we are most concerned about is not a vulnerability nobody finds. It is one somebody finds, reports, and then waits months to hear about. That is why the payment clock starts when the report arrives rather than on a date we choose, and why the balance is paid at ninety days even if our own fix is late."

QoreChain enforces the NIST post-quantum suite at protocol level: ML-DSA-87 (Dilithium-5, FIPS 204) for signatures, ML-KEM-1024 (FIPS 203) for key encapsulation and SHAKE-256 for hashing. Mainnet launched on June 7, 2026.

The QoreChain Association is a member of the PKI Consortium, the industry body advancing public key infrastructure and post-quantum migration alongside Microsoft, DigiCert, IBM and Thales, and a member of the Crypto Valley Association. Programme terms, scope and severity classification are published at https://qorechain.io/security.

About QoreChain

QoreChain is a quantum-safe, AI-native Layer 1 blockchain developed under the QoreChain Association, a Swiss association based in Rolle. The network combines NIST-standardized post-quantum cryptography, enforced at protocol level, with a triple-VM execution environment (EVM, CosmWasm, SVM) and AI-assisted smart-contract generation and auditing. More at https://qorechain.io.

This announcement is for informational purposes only and does not constitute an offer to sell or a solicitation of an offer to buy any token or security in any jurisdiction. The QoreChain Association makes no representation regarding the future market price or performance of QOR.

Press Office
Qore Chain Association
+40 799050548
press@qorechain.io
Visit us on social media:
LinkedIn
YouTube
X
Other