- A security flaw in GoBalance lets attackers steal the identity keys of dark web sites running on Tor.
- The bug hit Dread, a major dark web forum, twice in three days. Another marketplace called Omega was also affected.
- An independent researcher published a patch on GitHub, but no official fix had been confirmed as of October 9, 2026.
A security tool used by some dark web platforms had a serious bug. That bug may have let attackers take over hidden websites without ever breaking into their servers. The flaw was found in GoBalance, a program that helps spread website traffic across multiple servers while keeping one Tor onion address.
Searchlight Cyber published its technical findings on October 8, 2026, linking the attacks to a weakness in how GoBalance handles cryptographic signing. The Hacker News followed with its own report on October 9. The original Onionbalance software and Tor itself are not affected by the flaw.
A Simple Coding Error Handed Over the Keys
GoBalance is a Go-based version of Onionbalance. It keeps one onion address active while spreading traffic across several backend servers. But according to Searchlight Cyber, GoBalance mishandles private keys during signing.
Those keys are 64 bytes long. The vulnerable code only passes the first 32 bytes to the signing step. That missing half removes the randomness needed to keep the signature safe. Without that randomness, the process becomes predictable.
An attacker can then calculate the missing value. Using just one publicly visible service descriptor, they can recover the site’s master identity key. They do not need access to the target’s server or database to do this.
The master key controls the site’s onion identity. Anyone who gets it can create valid-looking descriptors. They can then redirect visitors to a fake site under their control. Visitors who log in to that fake site could hand over their credentials without knowing anything is wrong.
Cybersecurity incidents can also put sensitive technical credentials at risk, as seen in hackers’ claim of a Stripe Data breach involving 33GB of data and 1,033 API keys.
However, the flaw does not give attackers direct access to the real server, its files, or its stored data. The danger is what happens after the redirect, when users trust the fake address.
Dread Got Hit Twice; Omega Went Offline
The attacks began on October 5, 2026. Dread, one of the most well-known forums on the dark web, had its main onion address taken over and redirected to a rival platform called Conclave. Dread’s administrators first thought an accidental key exposure during a software update caused the problem.
Then on October 7, attackers took over Dread’s secondary address as well. Searchlight Cyber said this second takeover provided stronger evidence that attackers were actively exploiting the GoBalance vulnerability, not just a one-time accident.
Dread’s team said they found no signs that their servers had been broken into or that their database had been accessed. But they warned users that traffic interception could not be completely ruled out. They advised everyone to change their passwords.
On October 8, another platform called Omega announced it had taken its old onion address offline because of the GoBalance bug. It moved to a new replacement address. Dread’s administrators also said other marketplaces may have been hit, but the total number of affected sites had not been confirmed at the time of reporting.
A Patch Exists, but No Official Fix Has Been Confirmed
An independent researcher named Kolmteistov published a GitHub package that addresses the vulnerability. The package covers two attack paths found in the GoBalance master branch at a specific commit.
The first attack path is the key recovery flaw described above. The second involves insufficient checking of instance descriptors. According to the researcher, this second path could let attackers redirect traffic without even recovering the master key. That second claim has not been independently confirmed by the reporting reviewed for this article.
The GitHub package includes a patch, a modified source version, and regression tests. It shows that a public fix is available. However, The Hacker News reported on October 9 that it could not find an official advisory or a CVE identifier from the GoBalance maintainer. An official endorsement of the fix had not been confirmed as of that date.
Site operators using GoBalance should check their setups carefully and verify any fixes before applying them. A patch cannot undo an earlier key theft. Sites where the master key may already be compromised should move to a completely new onion address.
Users should treat old addresses as potentially unsafe. They should only trust replacement addresses confirmed through signed, official announcements from the platform team.
The incidents show how a small error in a cryptographic process can give attackers control over an entire hidden service. No server breach is needed. The damage happens at the identity level, quietly, before most users ever notice something has changed.
