If you have funds with AnomaPay, the practical question is whether you can still reach them, not whether a loss has already been confirmed. On November 11, 2026, at 17:43 (UTC+8), PANews reported that AnomaPay disclosed on X an external security vulnerability in the RISC Zero proof system it uses. AnomaPay said the flaw could put user funds at risk. No confirmed theft or loss figure was reported.
To protect users, the risc0 verifier behind Anoma was paused and is to be upgraded by the RISC Zero team. AnomaPay said money already deposited remains safe, but it cannot be accessed until the Anoma protocol is upgraded to V2, the version meant to include RISC Zero’s new security update. That upgrade was expected to take about two weeks. AnomaPay described the downtime as undesirable, but necessary to protect funds.
The trade-off is accessibility against a temporary lock. Deposits were described as retained, not lost, while ordinary access is held. The notice did not discuss confidentiality of keys or any backup and redundancy arrangement; it addressed an external proof-system flaw and a protocol upgrade. Nothing in the report says the pause or the later upgrade removes every risk.
AnomaPay said users do not need to do anything. After the upgrade, funds are expected to migrate automatically to V2, and access is expected to return with that migration. The only check supported by the report is to wait for that stated upgrade rather than treat the pause as a request to move funds yourself.
Original report: PANews, November 11, 2026
