ixo Blockchain CVE-2026-61604

Exploitable against any ixo Blockchain node running a version prior to v8.0.0 with the x/bonds module enabled (its default state before the fix). The specific prerequisite is that the target victim holds a balance in a token that some bond can use; the attacker needs only their own ordinary account to create a DID and add the victim's address as a blockchainAccountID verification method - no victim keys, signatures, consent, or prior compromise are required. The attack reaches the vulnerable logic through top-level transactions, authz, CosmWasm, or ICA routes, and also the bonds batch EndBlocker. The only limiting factor is deployment scope: it affects the ixo network specifically, and remediation is impossible without the whole network running the patched v8.0.0 binary since the flaw is in consensus state-machine logic.

This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 9.3) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack, and the advisory explicitly confirms real-world exploitation on ixo mainnet (ixo-5) on 2026-06-20 - actual fund theft occurred. Note the distinction: this is exploitation confirmed by the GitHub Security Advisory, but the CVE is NOT listed in CISA KEV, and no reusable POC exploit code is flagged in the input, so per strict signal definitions there is no public exploit identified at time of analysis even though a live incident is documented. EPSS, KEV, POC, and SSVC fields are all absent from the input and cannot be cited. I dispute the vendor's confidentiality rating: the flaw is theft of on-chain balances (unauthorized state modification and irrecoverable loss of victim funds), which is an integrity/availability impact - VC:H (data disclosure) is not well supported since no secret data is exposed. Because the root cause is consensus/state-machine logic, the only remediation is running the patched v8.0.0 binary; there is no application-level workaround, which raises operational urgency for all node operators and validators.

An attacker creates a DID they control and lists a victim's on-chain address as a blockchainAccountID verification method without the victim's consent. They then submit a bonds message (e.g. MsgBuy/MsgSwap/MsgWithdrawShare) that causes the x/bonds module to move the victim's token balance into a bond the attacker controls, after which they withdraw and bridge the proceeds off-chain. No victim keys, signatures, or system compromise are required; this was actually carried out on ixo mainnet on 2026-06-20, though no standalone public POC tool is referenced.