aelf

When aelf's plan was presented to investors on December 10, 2017, the proposed escape from shared-chain congestion was structural. A public testnet followed in 2018 and the MainChain launched in 2020. Applications could run on their own chains while sending block information back for indexing, so one busy product did not have to occupy the same execution queue as every other product.

That arrangement gave ELF two linked jobs. It paid for ordinary transactions and for application-chain indexing, and it carried votes for producer and candidate nodes. Holders chose the operators, but the documented Parliament process gave those operators the proposal machinery: producers submitted proposals, then producers and candidates voted on them.

The first scheduled halving arrived on December 12, 2024 and reduced the MainChain reward from 0.125 to 0.0625 ELF per block. It changed new issuance within the published maximum of one billion ELF.

The next large number told a different story. On January 18, 2025, aelf reported burning 295,519,800 ERC-20 ELF that had been deposited during the Mainnet swap. Those Ethereum tokens represented assets already moved toward the native network, so the burn cleaned up a legacy representation; it did not erase 295,519,800 native ELF from users.

On August 18, 2026, internal monitoring detected an unauthorized anomalous contract that appeared to attempt overflow and privilege escalation. aelf instructed every block producer to pause, began a hotfix and brought in an external auditor. The halt covered AELF MainChain and the tDVV application chain, turning the producer election from an abstract governance path into an operational emergency response.

That first notice did not settle the cause. The August 26 progress report described a more specific route: transaction parameters could deliver encoded .NET assemblies and instructions into the node contract-execution path. It linked 155 transactions to the activity—127 on AELF and 28 on tDVV—and reduced the payload set to five unique assemblies.

The five payloads could execute host commands, collect results, attempt outbound communication, access node-related key and configuration objects, and inspect infrastructure. aelf did not say that every payload ran on every node, that every targeted credential was obtained, or that sensitive data left the environment. Those questions remained with host, cloud, identity and network forensics.

Within the on-chain activity and wallet-key evidence reviewed by August 26, aelf found no evidence of unauthorized transfers from ordinary users or exposure of ordinary-user wallet keys. It simultaneously treated node signing keys and infrastructure credentials as potentially exposed and continued rotating or revoking them. The narrower user finding therefore cannot be expanded into a claim that every asset or credential was safe.

Public query endpoints could answer while production was still closed. The report said public transaction submission remained disabled and listed unfinished recovery gates: clean node rebuilds, key rotation, deterministic replay, permanent runtime isolation fixes and independent review. The latest official blog index examined through September 5 showed no later public completion report. The lasting consequence was specific: application workloads had been separated, but the software boundary and the elected response that restored them were still shared.