GoBalance’s truncated Tor key hands attackers the .onion addresses of dark-web sites
On October 8, 2026, Searchlight Cyber disclosed that GoBalance, the load balancer many dark-web sites use to stay reachable under DDoS, signs its descriptors with a private key cut in half — letting anyone recover a site’s master key from a single public descriptor. Any site that ever served an address through a vulnerable build must rotate to a new address, because a patch cannot un-leak an already-published key.
October 8, 2026. Security firm Searchlight Cyber disclosed a flaw in GoBalance, the load balancer that many dark-web sites use to stay reachable during denial-of-service attacks. Truncated. The tool passes only half of the Tor private key to the signer. One signature. A single published descriptor is then enough to reconstruct a site’s .onion master key and seize the address. Why it matters: the flaw is not in Tor or the original Onionbalance — it was born in the Go rewrite, and it has already led to the hijacking of both addresses of Dread, one of the largest dark-web forums.
A 64-byte key, cut in half
To understand the flaw, start with what an .onion address actually is: a public key. Whoever holds the matching private key controls the address. To stay reachable, a site publishes a signed record — the descriptor — that any Tor node can fetch, and GoBalance signs that record. The signing step is where everything goes wrong.
A Tor private key is 64 bytes long. GoBalance passed only the first 32 bytes to the Ed25519 signer and dropped the rest. The discarded half is the part that keeps each signature’s secret value hidden: it feeds the nonce that varies from one signature to the next. Without it, that nonce becomes a fixed number anyone can compute. The result: a single published descriptor carries enough information to recover the site’s private key, with no access to its servers at all.
What makes it worse is that the exposed key is the site’s long-term master key, not a short-lived one. A recovered key can sign valid descriptors for that address far into the future, redirecting visitors to a copy controlled by the attacker. Seizing the address does not, however, grant access to the site’s servers, database, or stored user data — the threat is to the privacy of visitors redirected toward a hostile mirror.
The nonce, or why half a key is enough to break everything
The mechanics deserve a closer look, because they are instructive. Ed25519 does not encrypt: it signs by deriving, for each message, a one-time number called the nonce, computed deterministically from the full private key — 32 bytes of seed plus 32 bytes of prefix. If that nonce repeats or becomes predictable, the signature leaks the private key. This is the principle behind the nonce-reuse attacks that broke ECDSA keys on the PlayStation 3 and on poorly implemented Bitcoin wallets.
By passing only the seed, GoBalance turned a nonce that should have been unpredictable into a fixed number. From a single signature, an attacker then solves the equation and recovers the secret scalar. This is not a weakness in Ed25519 — the primitive is sound — but in the caller that fed it half the key. The lesson applies to any integration: a cryptographic library only protects you if you give it the right inputs, and a predictable nonce is the equivalent of a door left open, even when the rest of the house is armored.
The Dread case: two addresses stolen in three days
The flaw surfaced through a real incident. Between October 5 and 7, 2026, both .onion addresses of Dread — a forum run by HugBunter and Paris — were taken over and pointed at a rival site, Conclave.
The sequence matters because it shows how a design flaw first masquerades as human error. On October 5, Paris said he had “stupidly uploaded dread’s main onion private key into a gobalance update”. That explanation holds for the first address. Two days later, the second address — a backup kept for premium members — was taken over as well. A backup is much harder to explain as a slip, and HugBunter then said the attacker had used a GoBalance flaw against several dark-web services. Searchlight Cyber takes the same view, treating the second takeover as the stronger sign the flaw was exploited, while counting the first address as a separate key leak.
On October 7, in a signed message, the operators said the forum had “migrated, permanently, following onion private key exposure due to a vulnerability in third-party software”, and that “other hidden services may be affected”. They stressed that Dread’s servers had not been breached. The forum has since moved to a new address and told users to change their passwords.
Who is exposed, and who is not
The real blast radius is still unclear. GoBalance is a Go rewrite of Tor’s Onionbalance, and it ships with EndGame, a widely used toolkit for keeping dark-web sites online during denial-of-service attacks. The flaw lives in the rewrite: Searchlight Cyber says the original Onionbalance and Tor itself are not affected.
The scope narrows further on one configuration detail. Only sites whose master key is stored in Tor’s own key format are exposed. GoBalance’s setup tool writes keys in a safer format that is not at risk, so not every site running GoBalance is vulnerable.
As for the total number of victims, no one knows. HugBunter said several dark-web markets had their addresses taken over, including some that had already shut down, without naming them or giving a number. At least one other site confirmed it publicly: Omega, a market, said on October 8 that it had taken its old address offline “due to an issue caused by the GoBalance bug” and moved to a new one.
No patch: this is a migration, not a fix
There is still no official fix. As of October 9, 2026, The Hacker News found no CVE identifier in the US NVD and no public advisory from the Tor Project or the GoBalance maintainer. Dread has said it plans to release a patched version and help affected sites move across. An independent researcher has published a patch and a proof of concept that recovers a master key from a single public descriptor, using only keys created for the test.
The operational lesson is counterintuitive: a patch fixes nothing here. Once a descriptor has been published, the key it leaks cannot be called back. A site that ran a vulnerable build must therefore create a new .onion address and migrate to it, as Dread and Omega did. For users of a potentially affected site, Dread’s guidance is three steps: change your password on that site and any related sites, treat the old address as unsafe, and trust a new address only after a signed announcement.
Operators should also treat this as a reminder about disclosure timing. Searchlight Cyber’s write-up arrived after the Dread and Omega takeovers had already happened, which means the window between a working exploit and public knowledge is exactly the window in which a service can be hijacked without warning. For hidden services, that argues for treating key material as disposable by design, and for rotating on a schedule rather than on demand.
Verdict
If you operate a hidden service behind a GoBalance instance, treat your current address as compromised: generate a new .onion address, migrate your users, and sign your migration announcement. A patch, whenever it ships, will not protect an already-leaked key. If you visit dark-web forums or markets, change your passwords, be wary of any redirect to a “new” domain, and accept only addresses confirmed by the operators’ signature. If you never touch the dark web, the lesson is the mechanics: a rewrite of a proven protocol — here Onionbalance into GoBalance — can break a guarantee as fundamental as a signature nonce, and go unnoticed for months.