Ontology Pauses Mainnet Block Production After Identifying Malicious Activity

Ontology, the identity-focused public blockchain known for its ONT and ONG tokens and decentralized identity infrastructure, has paused block production on its mainnet after its core development team identified malicious activity targeting the network. In a September 1 update, the project said user assets were not compromised and described the move as a precaution designed to give its team time to complete security remediation and a network upgrade before normal operations resume.

According to a security update published on its official site, the Ontology Mainnet will remain temporarily paused while the technical team and network validators carry out the security response. The project set a provisional target of restoring normal operations within 24 hours, subject to completing security checks, remediation, testing and validation, and said it will publish a further announcement once the network is ready to resume.

From Emergency Pause to Confirmed Malicious Activity

Ontology first suspended block production on August 31, describing the move as an emergency pause prompted by a potential security concern found during a routine security check. At that point, the team said no security incident had been confirmed and that there was no indication of any loss or compromise of ONT, ONG or other on-chain assets.

The picture sharpened the following day. In its September 1 announcement, the team said it had identified malicious attack activity targeting the network while reiterating that the investigation confirmed the activity does not involve or compromise the security of user assets. The mainnet, which has operated since 2018, will remain paused until the upgrade and verification work is finished, with the team coordinating with validators and ecosystem partners to complete the job.

Who Is Affected While the Network Is Down

With block production suspended, on-chain transactions are not being processed, and Ontology has advised users to avoid time-sensitive transfers until the network is confirmed to have resumed. ONT and ONG holders, validators and applications built on the Ontology EVM are the groups most directly affected by the outage. The team has said users do not need to transfer or otherwise act on their assets in response to the announcement, and that the temporary suspension is a proactive security measure rather than a response to confirmed asset loss.

The halt also touches services that rely on the network’s identity and reputation layer, including ONT ID credentials and applications that use Ontology for decentralized identity verification. Off-chain components such as the ONTO wallet remain available, but any on-chain interaction is effectively frozen until block production resumes. Ontology said it is completing remediation, upgrading network components and running extensive testing and validation, and it plans to coordinate with third-party security organizations for further assessment before any resumption, extending the review beyond its internal technical investigation.

A Wider Pattern of Preventive Chain Halts

The pause fits a broader pattern of network-level security responses across the sector. Cronos halted its blockchain on August 31 after an exploit of its Tectonic lending protocol, and a separate disclosure of a Solana card contract vulnerability has shown how quickly a security finding can disrupt day-to-day operations for users and builders.

Preventive pauses, in which a chain stops producing blocks to contain a suspected threat before losses are confirmed, have become a more common incident-response tool as attacks grow more sophisticated. Ontology’s update also flagged how artificial intelligence is contributing to the emergence of increasingly advanced security threats. For a network best known for decentralized identity and reputation rather than high-volume decentralized finance, the outage appears contained for now, but the full scope of the malicious activity and the timing of any resumption remain open questions tied to the outcome of the ongoing security review. The immediate test for holders and builders is whether the network returns within the stated 24-hour window or whether the third-party assessments surface issues that extend the pause further.