Vulnerabilities
GoBalance flaw lets attackers hijack Tor .onion addresses, dark-web sites affected
A bug in GoBalance lets attackers take over .onion addresses of dark-web sites by recovering secret keys. Some sites have already been hijacked, with users urged to change passwords.
Ross GrantUpdated 3 min read
The short version
A bug in GoBalance, software used by many dark-web sites, lets attackers take over a site's .onion address by working out its secret key from public information. This means visitors can be redirected to a fake version of the site. Some sites have already been affected and have moved to new addresses.
What happened?
A flaw in GoBalance, a tool used by many dark-web sites, lets attackers recover the secret key for a site's .onion address using only public information. This allows attackers to hijack the address and redirect visitors. The issue was disclosed on 8 October 2026, after major forum Dread and at least one other site were affected.
What is GoBalance and why does it matter?
GoBalance is a tool used by many dark-web sites to stay online during denial-of-service attacks. It helps these sites remain reachable by distributing traffic across multiple servers. GoBalance is a rewrite of Onionbalance, a similar tool used in the Tor network. The flaw only affects GoBalance, not the original Onionbalance or Tor itself, according to The Hacker News (opens in a new tab).
How the flaw works
The core of the problem is in how GoBalance signs records that help users find a .onion site. Each .onion address is tied to a cryptographic key pair: a public key (the address itself) and a private key (which controls it). To stay reachable, a site publishes a signed record called a descriptor. GoBalance's bug means it only uses half the private key when signing these descriptors, dropping the part that keeps the signature secret. This makes it possible for anyone to recover the full private key from just one public descriptor, without needing access to the site's servers.
Real-world impact: Dread and other sites
The flaw came to light after Dread, a major dark-web forum, had both its .onion addresses hijacked between 5 and 7 October. At first, Dread's operators thought it was their own mistake, but after a second address was taken over, they blamed a GoBalance vulnerability. The attackers redirected visitors to a rival site. Dread has since moved to a new address and told users to change their passwords. At least one other site, Omega, has also confirmed it was affected and moved to a new address. It is not clear how many other sites were hit, but Dread's operators believe several dark-web markets may have been targeted.
What has been done so far?
There is no official fix yet. No CVE (Common Vulnerabilities and Exposures) identifier has been issued, and there is no public advisory from the Tor Project or GoBalance's maintainer. An independent researcher has released a patch and a proof-of-concept showing the attack works, but this is not an official fix. Dread's operators say they plan to release a patched version of GoBalance and help other sites migrate. For now, any site that used a vulnerable version of GoBalance and published a descriptor must move to a new .onion address, as the leaked key cannot be revoked.
What should users and site operators do?
Users of affected sites should change their passwords on those sites and any others where they used the same password. They should treat old addresses as unsafe and only trust new addresses if confirmed by a signed announcement from the site's operators. Site operators should check if they used the vulnerable key format and, if so, generate new keys and addresses. Simply patching GoBalance is not enough if a descriptor has already been published.
Uncertainties and ongoing investigation
This flaw has only been reported by The Hacker News, based on disclosures by Searchlight Cyber and statements from Dread's operators. There is no confirmation yet from GoBalance's maintainer or the Tor Project. The full number of affected sites is unknown, and some details may change as more information comes out.
Claimed vs confirmed
- Confirmed
GoBalance flaw lets attackers recover .onion private keys and hijack addresses.
Searchlight Cyber disclosed the flaw and Dread's operators confirmed their addresses were hijacked.
- Unconfirmed
Several dark-web markets have had their addresses taken over.
Dread's operator HugBunter claimed this, but did not name sites or provide numbers.
- Confirmed
Original Onionbalance and Tor are not affected.
Searchlight Cyber and The Hacker News both state only GoBalance is affected.
The impact
- Money
- There is no public information on financial losses, but affected sites could face costs for migration and potential loss of business. If a similar flaw affected a regulated business, fines could reach up to 4% of global turnover under GDPR.
- Reputation
- Sites that lose control of their .onion address risk losing user trust, especially if visitors are redirected to fake sites. Dread and Omega have had to publicly announce the issue and move to new addresses.
- Customers
- Users of affected sites are at risk of phishing or credential theft if they visit a hijacked address. They should change passwords and only trust new addresses confirmed by signed announcements.
Why it matters
This flaw puts users of affected dark-web sites at risk of being redirected to fake sites, which could steal their passwords or other sensitive information. Site operators must act quickly to protect their users and reputations.
How does it work?
GoBalance signs Tor descriptors using only half of the private key, dropping the part that keeps the signature secret. This lets anyone who sees a public descriptor recover the full private key, and thus take over the .onion address.
Key points
- GoBalance flaw lets attackers recover .onion private keys from public data.
- At least two dark-web sites, including Dread, have had addresses hijacked.
- No official fix or CVE exists yet; sites must move to new addresses if exposed.
- Users should change passwords and verify new addresses via signed announcements.
- The original Onionbalance and Tor are not affected, only GoBalance.
Sources
The Hacker News
Reference
