GoBalance’s truncated Tor key hands attackers the .onion addresses of dark-web sites

On October 8, 2026, Searchlight Cyber disclosed that GoBalance, the load balancer many dark-web sites use to stay reachable under DDoS, signs its descriptors with a private key cut in half — letting anyone recover a site’s master key from a single public descriptor. Any site that ever served an address through a vulnerable build must rotate to a new address, because a patch cannot un-leak an already-published key.