- Monero suffered an 18-block reorganization attack that reversed 117 transactions.
- XMR’s price rose 7% on the same day.
- The attack was carried out by Qubic, which controls over 51% of Monero’s mining power.
Monero suffered an 18-block reorganization attack on Sunday, which reversed 117 transactions, marking another notable security breach on the privacy-focused exchange. This attack occurred despite XMR increasing by over 7% during the same period.
On Sunday, 5:12 AM UTC, reorganization of block 3499659 started and ended at block 3499676 around 43 minutes later. Node operators confirmed the incident through command-line console data shared on social media platforms. A cryptocurrency protocol researcher, Rucknium, confirmed the breach by looking at GitHub documentation.
Qubic, which is a layer-1 AI-oriented blockchain and mining pool, made the attack following its control over 51% of the Monero hash rate. The same entity conducted a six-block reorganization earlier in July, establishing a pattern of network manipulation.
Nothing to see here. Qubic just pulled a casual 18 blocks reorg on Monero 🤷 pic.twitter.com/fwSFY3olNu
— zuqka ױ (@AvdiuSazan) September 14, 2025
According to market data, XMR was at $224.16 during the reorganization, and it increased 7.4% from $287.54 to $308.55 within a period of eight hours. This price action was against the normal market trends during security incident cases and at the time when the larger cryptocurrency markets fell by 1%. At the time of writing, XMR is trading at $304.93, up 5.57% in the last 24 hours.
Community Response and Reliability Concerns
Monero has faced several attacks, which has led to a debate regarding its sustainability as a payment network. Cryptocurrency analyst Vini Barbosa declared on X that he would no longer accept XMR payments until the security problems are sorted.
Crypto podcaster Xenu, who was the first to air the reorganization, referred to it as the biggest in the history of the Monero network. Notably, industry observers believe that Qubic is trying to stabilize the price of XMR by effecting these interventions, but the true intentions of the entity are not entirely clear.
Monero was hit by an 18 block reorg a few hours ago, which invalidated 118 transactions. This is the largest reorg in Monero's history. Unsurprisingly ***ic is looking for any way to stay relevant and to stop the bleeding of their dumping price.
— xenu (@xenumonero) September 14, 2025
The attacks highlight the vulnerabilities in proof-of-work blockchain systems when mining power is centralized. Yu Xian, the founder of a blockchain security firm SlowMist, said that unless issues of reorganization are taken seriously, this menace will remain looming over Monero.
如果门罗币社区没人去认真对待区块重组之事，那这把达摩克利斯之剑就一直悬在门罗币头上…不一定会真的做双花攻击，但有这种能力了…也不一定非得严格超过 51% 算力… https://t.co/hDI3A1kK5u
— Cos(余弦)😶🌫️ (@evilcos) September 14, 2025
Proposed Solutions and Network Security Measures
According to Rucknium, a temporary solution will be the Domain Name System (DNS) checkpoints by the operators of the Monero nodes. This methodology entails the nodes downloading authoritative block information on the community DNS servers to hinder unauthorized reorganizations.
Nevertheless, the presence of DNS checkpoints creates centralization issues, which are incompatible with Monero’s principles of decentralization. The solution relies on trusted servers, which may affect the essence of the network.
As mentioned in our previous news brief, several solutions for eliminating 51% attacks have been considered in the Monero community before. Among the ideas were the localization of mining hardware, using merge mining algorithms, and using ChainLocks technology developed by Dash. The other recommendation was to permit the mining of XMR together with Bitcoin and other cryptocurrencies.
This is what looks like the 19 reorganization blocks in my monerod $XMR pic.twitter.com/30awmyqgCb
— Ʊɬɱʘ 🏴 a³ ɱ ᕮ 𐤊 ױ א ⛛ (@Ulmonan0) September 14, 2025
All of these solutions have failed to be adopted, and Qubic can still continue to control the network. The new attack was bigger than the existing 10-block lock in Monero that was built to safeguard transactions against reorganizations to a depth of 10 blocks.
