GoBalance Truncates Tor 64-Byte Keys to 32 Bytes, Enabling Master Key Recovery from Public Descriptors
GoBalance's key truncation flaw allows full recovery of Tor master keys from public descriptors, leading to .onion hijacks at Dread and Omega. Only Tor-format keys are affected; no CVE or official patch exists yet. The incident highlights systemic anonymity risk from third-party load-balancing tools used across dark-web infrastructure.
Sites that have not yet rotated addresses remain at immediate risk of visitor redirection without server compromise. Independent verification of the PoC against live descriptors would confirm the scale; current public statements from affected operators already demonstrate at least three confirmed migrations.
Searchlight Cyber: At least four additional dark-web markets will publish new .onion addresses by 15 November 2026
Sources (3)
- [1]Searchlight Cyber Disclosure(https://searchlightcyber.com/gobalance-flaw)
- [2]The Hacker News Report(https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html)
- [3]Omega Signed Statement(https://omega.onion/statement)