A truncated-key flaw in a widely used Tor load balancer exposed every published descriptor to a complete identity takeover — and Dread paid the price first.
Between October 5 and 7, both of Dread's .onion addresses were hijacked and redirected to a rival platform. The operators initially blamed an accidental key upload. Then the backup address — kept separately, supposedly safe — went down too. That's the part that doesn't fit an accident.
On October 8, Searchlight Cyber published a technical analysis that explains the second takeover: a flaw in GoBalance, the Go-based load balancer bundled with the EndGame anti-DDoS toolkit, let anyone compute a site's master identity key from a single public descriptor. No server access needed. No brute force. Just math on data anyone on the Tor network can fetch.
As of October 9, no CVE has been assigned, there is no official patch from GoBalance's maintainer, and no Tor Project advisory has been issued [1]. Dread has moved to a new address. So has Omega, a darknet market that confirmed the same bug hit them.
What GoBalance Is and Why It Matters
Dark-web sites are hit by distributed denial-of-service attacks constantly, often from competitors trying to take them offline. The standard response has been EndGame, a self-hosted anti-DDoS toolkit that places multiple frontend servers in front of the real backend. GoBalance sits on top of that: it combines the frontend descriptors so visitors see a single .onion address rather than several separate ones.
GoBalance is a rewrite of the Tor Project's own Onionbalance tool, done in Go. The rewrite is where the problem was introduced. The original Onionbalance and Tor itself are not affected [2].
The Cryptographic Mistake
To understand the flaw, you need to know a little about how Tor's v3 onion services work. An .onion address is effectively a hash of an Ed25519 public key. To remain reachable, a site publishes a signed record called a descriptor to the Tor network. Any Tor client can fetch that descriptor to find the site's introduction points and connect.
Ed25519, in its standard form, uses a 32-byte seed. Tor's own key format skips the seed: it pre-expands the key to 64 bytes and stores those directly. Those 64 bytes are a 32-byte secret scalar (a) followed by a 32-byte PRF key (h). The scalar is the "real" secret; h is what gets mixed into every signature's nonce to keep it unpredictable.
GoBalance's blindedSign function checks whether the key is in Tor format and, if it is, calls identityKey.Seed() before passing to the signer. Go's ed25519.PrivateKey.Seed() returns only the first 32 bytes. For a Tor-format key, that's the scalar a. The second half — h — is silently dropped [2].
With h gone, the nonce derivation inside blindedSignP2 looks like this:
k := esk[32:] // esk is only 32 bytes — k is empty
tmp := sha512.Sum512([]byte("Derive temporary signing key hash input" + string(k)))
kPrime := tmp[:32] // constant: SHA-512 of a fixed string, same for everyoneThe nonce for every signature GoBalance produces on a Tor-format key becomes the SHA-512 of a fixed string. It's public. It's the same for every affected service. And because the nonce is known, the scalar a — the master secret — can be extracted from any published descriptor with straightforward arithmetic.
What an Attacker Actually Does
An Ed25519 signature is a pair (R, S). Security holds because the nonce r used to compute R is unpredictable. When GoBalance produces a vulnerable signature, r can be computed by any observer. That makes the signature equation linear with one unknown — the secret scalar. Solving it is basic modular arithmetic, not a break of Ed25519 itself [2].
Because onion signing uses a blinded key derived from the master identity key, the recovered value is the blinded scalar. Unblinding it — using the public blinding multiplier that anyone can derive — yields the master identity scalar directly.
From there, the attacker can sign valid descriptors for the address in any time period, past or future. They publish their descriptor to the Tor network, it overwrites the legitimate one, and visitors who connect are sent to wherever the attacker points them.
One descriptor is all it takes. The PoC code published by an independent researcher confirms this, claiming that a master key can be recovered from a single fetched descriptor [3]. UnpanicTech has not run the PoC.
What the attacker cannot do through this flaw alone: access the site's servers, read its database, or obtain stored user credentials. The address is a pointer. A takeover redirects the pointer; it doesn't open the filing cabinet it was pointing to. Whether the attacker then intercepts traffic or presents a phishing copy of the site is a separate step that the flaw enables but doesn't guarantee.
A Second Vulnerability: Forged Descriptors Without Key Recovery
The independent PoC repository identifies a second, separate critical flaw in GoBalance. The RegisterDescriptor function accepted incoming instance descriptors without verifying that the blinded key they claimed to carry actually corresponded to the frontend's identity [3].
Because subcredentials are derived from the blinded key embedded in the descriptor itself, an attacker could construct a cryptographically self-consistent descriptor using their own keys and have the GoBalance frontend republish it as though it belonged to the victim site. Traffic hijack, without needing to recover the master key at all.
The two flaws are independent attack paths to the same outcome. The Searchlight Cyber report focuses on the nonce-leakage flaw; the PoC repository documents both and provides fixes for both. Whether either or both contributed to the Dread incidents has not been publicly confirmed.
What Happened to Dread
Dread is one of the larger forums on the dark web — a venue for market reviews, operator announcements, and community discussion. It runs two .onion addresses, a main one and a backup kept for premium members as a DDoS fallback. Both run GoBalance.
On October 5 at around 05:31 UTC, the primary address began displaying a notice claiming it had been hacked, followed by a message from the operator of a rival site called Conclave claiming possession of Dread's secret key. Later that day, co-administrator Paris issued a statement saying he had accidentally included the private key in a software archive uploaded during a deployment [2]. HugBunter, Dread's founder, reiterated this on October 6.
The backup address then went down on October 7 at roughly 02:29 UTC. A message posted there — written in Russian — disputed the accidental-upload account and argued that the loss of a second, separate key couldn't be explained by a single mistake. HugBunter later that day acknowledged the GoBalance zero-day and said it had been used against multiple darknet services. He maintained that the primary address had been lost through Paris's accidental upload, while the backup was taken via the software flaw.
Searchlight's analysis supports that distinction. The first takeover is consistent with a key that was accidentally made public. The second is more naturally explained by the GoBalance flaw, since a separate backup key that was never uploaded shouldn't be accessible through an accidental leak alone.
Dread has since migrated to a new address and told users to change their passwords on the forum and on any other services that may have been affected. HugBunter said the servers were not breached and there was no confirmed database access, but he couldn't rule out that traffic had been intercepted during the period the attacker held the address.
Who Else Is Exposed
The flaw affects only sites whose master key is stored in Tor's own 64-byte expanded format. GoBalance's setup tool generates keys in a different, non-Tor format — so not every site that runs GoBalance is vulnerable. Sites that generated their keys through Tor itself and then handed them to GoBalance are the ones at risk [1].
How many sites that is remains unclear. HugBunter said several darknet markets had their addresses taken over, including some that were already defunct. Omega, a darknet market, confirmed via a signed notice on October 8 that it had taken its old address offline and moved to a new one due to the GoBalance bug [1]. No other sites had publicly confirmed as of October 9.
The Patch Situation
There is no official fix. As of October 9, GoBalance's maintainer has published no advisory and no corrected release. A branch called patch1 exists in the upstream repository, but the independent PoC researcher states that it does not fix either of the two critical vulnerabilities [3].
Dread's team has said it plans to release a patched version and help affected sites migrate. The independent researcher has published a complete unified diff and a pre-patched source tree that fixes both flaws, along with regression tests [3]. That patch is not an official release, and operators considering it should review it independently before deploying.
The patch for vulnerability 1 ensures the signer receives the full 64-byte extended key rather than just the scalar, and adds a panic-on-truncation guard. For vulnerability 2, it adds three-layer descriptor verification: certificate signature, descriptor signature, and a binding check that compares the blinded key in the incoming descriptor against what the frontend independently computes from its own identity and the current time period.
What Operators and Users Should Do
The nature of the flaw makes patching alone insufficient. Once a descriptor has been published to the Tor network, it can't be recalled. Anyone who fetched it before a fix was deployed already had everything needed to compute the master key. The only safe response for a site that ran GoBalance with Tor-format keys is to generate a new .onion identity and migrate to it — which is what Dread and Omega have done.
For operators who need to act now:
- Determine whether your GoBalance instance was configured with a Tor-format master key (stored in Tor's own
hs_ed25519_secret_keyformat). If yes, treat the key as compromised. - Generate a new .onion identity using Tor's key generation tools.
- Publish your new address through signed announcements on channels you control independently of the affected .onion addresses.
- Migrate users explicitly; don't assume they'll find the new address automatically.
- Apply a vetted patch before deploying any new GoBalance instance.
For users of potentially affected sites: treat any address that hasn't issued a signed migration notice as unverified. Change your password on any site that has confirmed exposure, and on services where you use the same password. Don't assume the content served by an old address comes from the legitimate operators.
What This Tells You About Dark-Web Infrastructure
GoBalance is not obscure software. It's the Go component that makes EndGame's anti-DDoS protection actually scale — without it you're limited to a single frontend. Dread promoted EndGame extensively; the toolkit spread because it solved a real problem for darknet operators facing relentless DDoS campaigns. That uptake is now the attack surface.
The underlying error is a fairly classic case of API mismatch: Go's ed25519.PrivateKey.Seed() returns 32 bytes because that's what standard Ed25519 expects. Tor's expanded-key format holds 64 bytes. The GoBalance rewrite called Seed() on a Tor-format key without accounting for the difference, silently discarding the second half. No explicit error. No warning. Just a constant nonce baked into every signed descriptor.
What's harder to explain is why this wasn't caught earlier. GoBalance has been used in production by high-profile darknet sites for some time. Tor's key format and the expanded-scalar convention are documented. A code review of the signing path — specifically the branch that handles Tor-format keys differently from standard keys — would likely have surfaced the missing bytes. It didn't, apparently, until the takeovers started and people began looking.
The claim that AI was involved in discovering the flaw — attributed to HugBunter in Searchlight's timeline — is interesting but unverified. Searchlight doesn't endorse it; it simply reports that HugBunter said so. Whether true or not, the flaw itself is the kind of thing that shows up in manual code review of cryptographic signing paths, not something that requires novel techniques to find.
What Remains Uncertain
Several things are not established:
- Whether the primary Dread address was lost through the accidental key upload or the GoBalance flaw or both — Searchlight's analysis treats them as separate events, but the evidence doesn't conclusively rule out the flaw being used for both.
- How many sites are currently affected and whether active exploitation beyond the confirmed incidents is ongoing.
- Whether any user traffic was intercepted during the period the attacker held either address.
- Whether the upstream maintainer will release an official fix, and when.
The PoC is public. Any site that ran GoBalance with Tor-format keys and published descriptors — including sites that are now offline — should be considered potentially compromised until the key question is addressed.
Sources & References
- The Hacker News — "GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys," October 9, 2026
- Searchlight Cyber — "Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire," October 8, 2026
- kolmteistov — "GoBalance Security Patch & PoC," GitHub, October 2026
- Tor Project — "Tor Address Specification"
- Go standard library — crypto/ed25519 package documentation