The GoBalance Flaw and the 2026 Onion Key Leak
The GoBalance vulnerability is a signing bug in a load balancer. It let anyone rebuild a site's onion private key from a record the site had already published, then stand up a copy at the real address. Searchlight Cyber published the analysis on 8 October 2026. The write-up is by Gareth Owenson and David Andreas. There was no CVE and no official patch at that disclosure.
The week it surfaced, Dread lost both of its old addresses, Omega burned its address and signed a move, and Nexus had already gone quiet with nobody left to sign anything. The servers behind those sites were not what leaked. The address was.
What EndGame and GoBalance Are
EndGame is the anti-DDoS kit large Tor sites run so a traffic flood does not take the site offline. GoBalance is the part of that kit that spreads visitors across more than one server. It is a Go rewrite of Tor's Onionbalance, and it is the piece that signs the record clients use to find the site.
Most large markets and forums were running it in 2026, because a single server dies the first time someone aims a flood at it. The bug is in the rewrite's signing step. Onionbalance, the program GoBalance was copied from, does not have it. Running EndGame for DDoS protection is what put the vulnerable signer in front of the address.
Why an Onion Address Is Really a Key
A v3 onion address is an ed25519 public key, encoded so Tor Browser can show it as a hostname. There is no registrar and no renewal. Whoever holds the matching private key can publish records for that hostname for as long as the key exists, and Tor will treat those records as the site.
The record is called a descriptor. A site publishes a fresh one on a schedule so clients know which introduction points to use. The descriptor is signed, and it is public: anyone on the Tor network can fetch the current one. That publicity is the design. Clients have to be able to read it. The signature is supposed to prove the private key's owner wrote it, and nothing in the descriptor is supposed to reveal the private key.
The Flaw, in Plain Terms
GoBalance signed those descriptors with half of a Tor private key. A key in the format Tor writes to disk is 64 bytes. The first 32 are the secret that signs. The second 32 are what keeps each signature's one-time secret from collapsing into a number a stranger can compute. GoBalance passed only the first half to the signer and dropped the rest.
With that half missing, the one-time secret is no longer hidden. A single published descriptor then carries enough to recover the long-term master key. The recovery uses the descriptor the site already gave to the network. It does not need a login, a stolen backup, or a foothold on the server.
The exposed set is narrower than "anyone running GoBalance." The bug bites when the master key is stored in Tor's own file format. GoBalance's setup tool writes a different format, and that format does not take this path. A site can be running the kit and still be outside the bug. Tor itself, and the original Onionbalance, sign with the key intact.
Why a Master-Key Leak Is Catastrophic
The key that comes out is the master key, not a key that dies with this week's descriptor. It can sign valid records for that onion address in any later period. An attacker publishes their own descriptor, Tor hands visitors to their servers, and the hostname in the bookmark never changes.
What they do not get is the machine. The original servers, the database, and the files on disk stay where they were. Dread said exactly that after its addresses moved: the forum's servers were never touched. The damage is the front door. A copy of the login page, on the real address, run by someone else, will take whatever password a person types into it. Tor Browser has nothing to flag, because the address checks out.
Who Got Hit: Dread, Omega, Nexus
Between 5 and 7 October 2026 both of Dread's addresses were taken over and pointed at Conclave, a rival forum. The main address went first. Paris, the co-admin, said he had uploaded that address's private key by mistake inside a GoBalance update. Two days later the backup address, the one kept for premium members, went too. One uploaded file accounts for one key. It is a poor account of the second.
On 7 October HugBunter signed a statement that put both takeovers on a bug in GoBalance. Searchlight's write-up the next day treats the backup takeover as the clear use of the flaw, and leaves the first address as a key that may still have been the upload Paris described. Either reading ends in the same place: those two hostnames were no longer Dread's. The forum moved to a new address and told people to change passwords. The password advice is about logins typed into the copy during those days, not about a stolen database.
Omega did the thing a live market can do. The day after that statement it killed its original address for good and published the replacement in a notice signed with the same PGP key as its earlier announcements. The old hostname stays dead. A login page that still answers there is a clone trading on the story of the move.
Nexus could not make that move. Withdrawals had stalled at the end of September, the mirrors went quiet around 1 October, and nobody from the team has signed anything since. On 7 October the private keys for its onion addresses were public. A live operator answers a leaked key by abandoning the address and signing a new one. Nexus had no operator left to sign, so the old addresses stay with whoever holds the keys. A page that loads on them can be a copy. The exit and the leak are separate. The team taking the money is what ended the market. The keys are what lets the old address load a page again.
What a Fix Looks Like, and Why a Dead Market Can't Apply One
A corrected copy of GoBalance does not recall a descriptor already on the network. The master key those signatures exposed keeps signing. The address has to be a new one, created from a key this bug never touched, and readers have to be told about it by a signature from a key they already held.
A dead market stops at the signature. Dread and Omega still had the PGP key and someone willing to use it, so the move could be checked. Nexus did not. No patch, and no new hostname announced by a stranger, repairs an address whose master key is already public. At the 8 October disclosure there was no CVE and no advisory from the Tor Project or from GoBalance's maintainer. A patch shipped later would still leave every previously published descriptor where it is.
What This Means for an Address You Already Saved
An address you checked in the summer of 2026 is a check of the summer. After the first week of October, the same hostname can belong to someone else, and the only current evidence is a signature newer than the leak. The clicks for that check are in the how to use PGP guide. What the date inside a signed statement is worth, and what a gap in the schedule means, is the warrant canary page.
A new address that arrives unsigned, in a message or a post, is the cover the clones used the same week the real moves happened. If the operator cannot show a fresh signature from the key you already trust, what you have is the story of a move. The move is the signature.
GoBalance Questions
What is the GoBalance vulnerability?
The GoBalance vulnerability is a signing bug in the load balancer that ships with the EndGame anti-DDoS kit. A Tor private key is 64 bytes. GoBalance passed only the first 32 to the signer. One public descriptor was then enough to rebuild the site's long-term master key, with no access to the server. Searchlight Cyber published the analysis on 8 October 2026. There was no CVE and no official patch at the disclosure.
Can an old bookmark be taken over?
Yes, if that address was signed by a vulnerable GoBalance and the master key was in Tor's own file format. The recovered key can sign future records for the same address, so a bookmark can load a copy of the site run by someone else. Tor Browser shows no warning, because the address really is the one you saved. The original servers and database are not what the key opens.
Is Tor itself broken?
No. The bug is in GoBalance, the Go rewrite of Onionbalance. Tor and the original Onionbalance were not affected. A site is exposed only when its master key is stored in Tor's file format. Keys written by GoBalance's own setup tool use a different format, and that format is outside this bug.
How do I know a new address is the real one?
The operator signs the new address with the PGP key you already trusted, after the move. An unsigned 'new address' posted in the same week is the cover story every clone uses. Dread and Omega both published a signed move. Nexus had no one left to sign, so its old addresses were never replaced. The signature check itself is in the PGP guide.