If funds you deposited are suddenly out of reach, the holding question is whether they are gone or only locked while a fix is applied. That was the concern around AnomaPay in reporting published on November 11, 2026.
PANews reported that day, at 17:43 (UTC+8), that AnomaPay had disclosed on X an external security vulnerability in the RISC Zero proof system it uses. According to the report, the flaw could endanger user funds. To protect users, the risc0 verifier behind Anoma was paused and was to be upgraded by the RISC Zero team.
AnomaPay’s account of the trade-off, as relayed by PANews, separates the safety of deposits from the ability to use them. Funds users had already deposited were described as safe. Access was not. Those funds would stay temporarily inaccessible until the Anoma protocol is upgraded to V2, a version that includes RISC Zero’s new security update. The upgrade was expected to take about two weeks. AnomaPay said the downtime was not ideal, but necessary to protect user funds.
The notice does not describe a confirmed loss, and PANews did not publish any stolen amount. A statement that funds could be endangered is not the same as a measured drain. The report also does not ask holders to change backups, reveal secrets, or move funds by hand. Confidentiality of recovery material and redundancy of backups are separate questions, and this notice does not cover them. The only user instruction given is that no action is required. After the upgrade, funds were to migrate automatically to V2 and access was to be restored.
Pausing the verifier does not mean every risk is removed. It is the step AnomaPay described for keeping deposited funds in place while the proof system is updated. Treating the pause as a request to send keys, a seed phrase, or a manual transfer goes beyond what PANews reported.
Original article: PANews, November 11, 2026.
