Ethereum Classic miners reverse Core Geth v1.13.0 migration after warning

Classix reported that a disputed Core Geth v1.13.0 client was promoted as a security update for ethereum-classic-etc">Ethereum Classic (ETC) on September 14, 2026. The release was pushed without external review, prompting several mining pools to adopt it briefly before reverting to the officially maintained Argos client (v1.12.23).

Rapid, unreviewed release

The ethereumclassic/core-geth repository introduced v1.13.0 after 96 commits were merged directly to the main branch within 56 hours, adding 13,422 lines and deleting 3,977 lines. No pull requests or outside review were conducted. The repository is a fork of etclabscore/core-geth created in December 2024.

Mining pool response

Four 2Miners nodes ran Core Geth v1.13.0 at 12:09 UTC on September 15, but all switched back to Argos v1.12.23 by 23:35 UTC the same day. Other pools remained on 1.12‑series versions. Public node listings showed 11 v1.13.0 nodes at 07:33 UTC on September 15, dropping to 10 by September 16, with three matching hard‑coded bootnode IPs introduced by the new client.

No economic impact

Classix confirmed that no blocks, funds, or services were lost, and no chain reorganizations occurred. The incident was classified as high severity but low impact because the software altered consensus‑related behavior without causing recorded economic or transaction losses.

Questionable security claims

The v1.13.0 release claimed unpatched security issues in all v1.12.x releases. Classix reviewed the seven cited issues and found that five had already been fixed in prior Argos releases, while the remaining two did not affect ETC’s peer‑to‑peer or consensus paths. Notable CVEs (e.g., CVE‑2026‑22862, CVE‑2026‑26315) were already addressed in earlier Argos versions.

Protocol changes

Beyond the disputed security narrative, v1.13.0 re‑enabled Modified Exponential Subjective Scoring (MESS) and altered node discovery infrastructure. MESS, introduced in 2020, was disabled via ECIP‑1110 after Ethereum’s transition to proof‑of‑stake. The new client also replaced a long‑standing DNS tree signing key and hard‑coded three new bootnode IP addresses, removing older discovery trees (blockd.info and etcdisco.net).

Recommendations

• Continue using Argos v1.12.23 from the etclabscore/core-geth repository.
• Operators who migrated to v1.13.0 should revert, restore any rotated node keys, and verify MESS configuration.
• Consider diversifying client usage; alternatives include Nethermind, Besu, and Getc.
• Ethereum Classic GitHub administrators are urged to tighten repository controls, enforce proposal and review processes, and clearly label the disputed repository as unofficial.