⚠️ Security Advisory: "Blackcoin V4 / Quantum Quasar" Is an Unofficial, Unreviewed Fork

Author: BlackcoinDev — on behalf of the official Blackcoin.org / Blackcoin More team Date: 2026-07-04 Audience: Blackcoin users, investors, stakers, exchanges, pool operators, node operators Status: The official Blackcoin team was not consulted about this software and does not endorse it.

---

from: https://github.com/blackchainnl/QuantumQuasar/blob/main/SECURITY_ADVISORY.md

A repository at github.com/Blackcoin-Dev/Blackcoin (tagged v30.0.1, branding itself "Blackcoin V4 / Quantum Quasar") is distributing a heavily modified Bitcoin-derived node and wallet that claims to be a "quantum-resistant upgrade" for Blackcoin.

It is not the official Blackcoin More client (github.com/CoinBlack/blackcoin-more). The official team was never contacted, never asked to review it, and never approved it.

Reading the source code, this fork:

• Automatically copies your legacy ~/.blackmore wallet directory into a new ~/.blackcoin directory on first run — silently in headless mode, with no user consent — duplicating your private keys into up to three locations.
• Pressures users to move coins to a brand-new, unaudited "quantum" address type whose private keys are not derived from the wallet seed and cannot be restored from a seed backup. In the default unencrypted wallet, those ML-DSA private keys are written to wallet.dat in plaintext.
• Threatens to permanently lock out legacy coins after a hard-coded deadline, with no downgrade path back to legacy addresses once migrated.
• Decays migrated coins to zero via a "demurrage" rule unless the owner periodically broadcasts fee-paying attestation transactions — while a hardcoded list of treasury-exempt addresses (designated by the fork authors) bypass the decay.
• Introduces a parallel "Shadow Network" ledger that credits "Gold Rush" rewards as synthetic UTXO-set entries only upgraded nodes can see or validate, paid exclusively to quantum migration addresses, gated by a 10,000 BLK whitelist.
• Carries over the official blackcoin.org Qt organization domain and the official DNS seeds, so it presents itself to users as if it were an official release.
• Provides no reproducible-build attestations, so any precompiled binary could differ from the published source — including a tampered liboqs that leaks ML-DSA keys.

Whether this is a deliberate scam or merely an extremely reckless experimental fork is a question for auditors and the community. From a user-safety perspective, it has every structural property of a wallet-confiscation / coin-migration scheme, and users should treat it as hostile until proven otherwise.

Do not run it. Do not download binaries. Do not point it at a wallet that holds real Blackcoin. If you already ran it, read the recovery section at the end.

---

Their README text:

Blackcoin

This repository contains the Protocol V4 upgrade for Blackcoin. It keeps the legacy chain history and migration path while adding the Quantum Quasar V4 feature set for the PoSV4.0 upgrade release.

Current Upgrade Scope

• Gold Rush reward accounting through the legacy-compatible Shadow Network ledger.
• Quantum migration addresses backed by ML-DSA keys.
• Legacy-to-quantum wallet migration RPCs.
• EUTXO and RGB commitment primitives and raw transaction tooling.
• Blackcoin daemon, CLI, wallet, and Qt binary naming.
• Copy-only migration from legacy Blackcoin data directories used by prior nodes.

Upgrade Overview

Read doc/upgrade-v4.md for the public V4 transition overview, including the Gold Rush timeline, quantum address migration, staking changes, and first-run data-directory migration.

On first run without -datadir or -conf, blackcoind and blackcoin-qt look for a legacy ~/.blackmore data directory. If it is the only legacy data directory, the node copies it to ~/.blackcoin, converts blackmore.conf to blackcoin.conf, leaves the original intact, and writes a migration marker. If both .blackcoin and .blackmore exist, the GUI prompts the user and headless startup safely keeps .blackcoin unless -migratewallet=blackmore is supplied. Migration failures abort startup rather than creating or loading the wrong wallet. Operators should make sure there is enough free disk space for a full copy of the selected legacy directory and its backup.

The staking model includes quantum cold-stake principal preservation, stake-reward splitting between delegator and operator, tiered staking weights, autonomous redelegation, and a wallet/policy per-pool cap used to steer new delegations without changing consensus.

Legacy Blackcoin operators should read TRANSITION_GUIDE.md before testing this fork.

Build

Protocol V4 consensus requires liboqs 0.15.0 for ML-DSA quantum signatures. Release builds must use the pinned dependency tree:

make -C depends
./autogen.sh
./configure --prefix="$PWD/depends/$(./depends/config.guess)"
make -j8

For local development only, an exact-version host liboqs can be used instead:

./autogen.sh
./configure --with-system-liboqs
make -j8

Useful targets:

make -j8 -C src test/test_blackcoin
./src/test/test_blackcoin

The primary binaries are:

• src/blackcoind
• src/blackcoin-cli
• src/blackcoin-wallet
• src/qt/blackcoin-qt

Test

Run the focused Blackcoin checks:

./src/test/test_blackcoin --run_test=shadow_tests,blackcoin_tests --catch_system_errors=no
python3 test/functional/feature_blackcoin_phase.py
python3 test/functional/rpc_goldrushinfo.py
python3 test/functional/rpc_rgb.py

Run the full functional suite with:

python3 test/functional/test_runner.py

Development Notes

This repository still contains legacy Blackcoin compatibility names in places where they are protocol, URI, historical, migration, or test-framework compatible. New user-facing Blackcoin code should use the Blackcoin daemon, CLI, wallet, and configuration names.

License

Blackcoin inherits the MIT-licensed Blackcoin codebase. See COPYING for details.