Ontology Forces Urgent Node Upgrade After Restarting Chain Hit by Malicious Activity

Ontology’s mainnet is back online after an emergency security pause, and every sync-node operator is now being ordered to upgrade to version 3.1.5 without delay. The network halted block production on Aug. 31 after a daily security check raised alarm, with a follow-up investigation later confirming that malicious attackers were targeting the chain. The team says user assets were not touched, but the attack path and full recovery details remain undisclosed. Emergency Shutdown and Escalating Threat Assessment Ontology suspended block production on Aug. 31 after what was initially described as a potential security concern discovered during a routine daily security check. The immediate result was a network-wide pause that left on-chain transactions unprocessed. Ontology instructed users not to attempt time-sensitive on-chain transactions and made clear that ONT, ONG, or other assets did not need to be moved because of the announcement. The status shifted significantly on Sept. 1. In an update, the team escalated its language and said it had identified malicious attack activity targeting the network. At the same time, remediation, testing, and a network upgrade were already underway. Mainnet Restoration and Mandatory Upgrade Ontology announced that its mainnet resumed normal operation on Sept. 2 after the emergency security pause. With restoration complete, the project moved immediately to enforce a mandatory node upgrade. Sync nodes, which are infrastructure components that maintain a synchronized copy of the blockchain, must upgrade to version 3.1.5 to remain compatible with the network. The restoration notice states that the new software is required to maintain compatibility with the restored chain and ensure stable synchronization. Operators are told to upgrade as soon as possible, confirm their nodes are fully synchronized, and verify normal operation afterward. The urgency around the upgrade is directly tied to the restored network. Older software therefore carries a compatibility and synchronization risk, although the notice does not explicitly say that every unupgraded node has already failed. Timeline / Network Phase Official Status Required Operator Action Aug. 31 - Daily security check flags issue Block production paused; transactions left unprocessed Users told to avoid time-sensitive transactions; no need to move ONT or ONG Sept. 1 - Investigation escalates Malicious attack activity identified targeting network Remediation, testing, and network upgrade underway Sept. 2 - Mainnet restoration Normal operation resumed after safety assessment All sync-node operators must upgrade to v3.1.5 and verify full sync What Operators Must Do Now For node operators, the instruction set is specific and immediate. The network now expects full compliance with version 3.1.5 to avoid synchronization problems. Key requirements in the restoration notice include: Mandatory software version: 3.1.5 Action: Upgrade as soon as possible Post-upgrade step: Confirm nodes are fully synchronized Verification: Check normal operation after the upgrade Compatibility risk: Old software may face synchronization failures The notice does not mention a hard deadline beyond insisting that operators act quickly. But the wording makes it clear that the upgrade is not optional for nodes that need to stay in lockstep with the restored chain. User Assets and Investigation Status Ontology has maintained throughout the incident that the malicious activity did not involve or compromise user assets. That remains the network’s assessment because Ontology has not yet published an independent forensic report. The project’s own investigation is the only source of the asset-safety claim so far. The lack of disclosed attack details also leaves broader questions open. The specific path attackers used, the vectors involved, and the full scope of network impact have not been released in the restoration notice. Ontology said block production would not have restarted until the network had been assessed and deemed safe to operate, but the wider service recovery timeline and forensic findings remain under wraps. Network Status and Market Context The restart on Sept. 2 puts Ontology back into active block production, but the incident is still fresh. For a network whose core function relies on continuous uptime, the emergency shutdown and the mandatory upgrade represent a meaningful operational disruption. No independent audit has been published, and no immediate official statement has been made about the financial or ecosystem impact of the attack. The focus now is on synchronization stability and ensuring all sync nodes are running v3.1.5. Users are back to normal network conditions, though the absence of a public technical breakdown leaves the broader security community without a full forensic picture. Why Did Ontology Restart Its Mainnet? Ontology resumed block production on Sept. 2 after completing an emergency security assessment and network upgrade. The restart followed a pause triggered by a daily security check that later revealed malicious attack activity. What Version Do Ontology Sync Node Operators Need? Sync node operators must upgrade to version 3.1.5 immediately. The software is required to maintain compatibility with the restored chain and ensure stable synchronization with the network. What Happened to Ont and Ong During the Network Pause? During the pause, on-chain transactions were left unprocessed, but Ontology told users they did not need to move ONT, ONG, or other assets. The project said user assets were not involved in or compromised by the malicious activity. Were User Assets Affected by the Malicious Activity? Ontology said its investigation found that the malicious activity did not involve or compromise user assets. However, no independent forensic report has been published, and the project’s assessment has not been independently verified. Is Ontology Network Fully Operational Now? Ontology said its mainnet resumed normal operation on Sept. 2. The full recovery remains tied to all sync-node operators completing the mandatory upgrade to version 3.1.5.