As reported by Odaily on November 11, 2026, at 17:44 UTC+8, AnomaPay said an external security vulnerability had been found in the RISC Zero proof system it uses. The issue could put user funds at risk, and the risc0 validator behind Anoma has been paused as a precaution. The RISC Zero team is expected to provide an upgrade.
AnomaPay said funds already deposited are safe but cannot be accessed until the Anoma protocol upgrades to V2 with the new RISC Zero security update. At the time of the report, the upgrade was expected to take about two weeks. AnomaPay said users need take no action: after the upgrade, funds will migrate to V2 automatically and access will resume.