BNB Chain, Base respond to Reth security bug affecting EVM networks

BNB Chain and Base have issued security updates after a bug in the Reth Ethereum execution client raised concerns about incorrect blockchain state calculations across several Ethereum-compatible networks.

In a November 6 notice, BNB Chain acknowledged the security risk affecting Reth but said its opBNB network does not use op-reth, while the impact on BSC-Reth remains limited.

Notice: We are aware of the security risk affecting the Reth client. However, opBNB does not use op-reth, and the impact on BSC-Reth is limited.

The team is actively working on a hotfix and monitoring the situation closely to ensure network security.

No action is required from…

— BNB Chain (@BNBCHAIN) November 6, 2026

The team said it was preparing a hotfix and closely monitoring the situation to protect network security. Developers and users were told that no action was required at the time of the announcement.

Base, meanwhile, confirmed that it had resolved the issue on November 5, after identifying the vulnerability a day earlier. The Coinbase-backed layer 2 network said its operations were not disrupted and user funds were unaffected.

The problem concerns how certain versions of Reth calculate a blockchain’s state root, a cryptographic value representing the current state of accounts, balances, and smart contract storage.

An incorrect calculation could cause affected nodes to disagree with the network’s actual state, potentially interrupting synchronization or producing unreliable state proofs used by applications.

Base releases patch after confirming blockchain state

According to an official status update, Base discovered on November 4 that the Reth bug could cause nodes to calculate an incorrect state root under certain conditions.

Because Base uses Reth as part of its execution infrastructure, its developers applied the mitigation and patched all block-building nodes on the same day.

The team subsequently recalculated the network’s state root and confirmed that it matched the correct value.

Base explained that its proof system independently verifies every state root, providing another mechanism for detecting inconsistencies in blockchain calculations.

“We’ve verified the current state root is correct and users were not affected,” the team said.

A software update, version 1.5.3, was released to prevent Base validators from halting when encountering invalid state roots.

Node operators were advised to install the update as soon as possible, although Base said they would not need to resynchronize their nodes or perform additional recovery procedures.

The network’s November 5 status notice listed a maintenance window running until November 7 at 16:19 UTC, while the public patch became available at 17:52 UTC on November 5.

Reth developers fix state root calculation bug

The underlying issue originated in Reth, an Ethereum execution client developed by Paradigm that is used directly or through modified versions across several blockchain networks.

A GitHub change merged on November 3 addressed an error involving how the client’s trie iterator handles certain cached branch boundaries.

The fix changed the iterator’s behavior when searching through stored blockchain data and introduced a regression test covering incremental state root calculations.

Reth developers subsequently included the correction in version 2.10.0, while patched versions of related software included op-reth 2.8.1 and Base’s 1.5.3 release.

Blockchain security firm Blockaid warned that unpatched clients could experience synchronization problems or return incorrect proofs through the eth_getProof interface.

The firm described the problem as a software correctness bug rather than a confirmed exploit and reported no known financial losses associated with the flaw.

The vulnerability prompted responses from networks using Reth-based infrastructure, although their exposure depended on the specific client implementations deployed.

BNB Chain’s announcement distinguished between opBNB, which does not rely on op-reth, and BSC-Reth, where the team acknowledged limited exposure while preparing its own fix.

LayerZero pauses some cross-chain services as precaution

The Reth issue prompted precautionary restrictions beyond the affected execution clients, particularly among services that rely on blockchain state verification.

Cross-chain interoperability provider LayerZero temporarily suspended some off-chain infrastructure connected to affected networks while software fixes were being deployed.

The restrictions delayed certain cross-chain messages, although reports citing the security response said the messages would not be lost.

Some decentralized finance services temporarily restricted deposits or cross-chain routing as operators assessed their exposure.

LayerZero provides interoperability infrastructure used by numerous blockchain applications. In September, Anchorage Digital selected LayerZero to support cross-chain transfers for stablecoins issued through its federally chartered bank.

The partnership named Tether’s USAT as the first stablecoin to use LayerZero’s Omnichain Fungible Token standard under the arrangement.

Separately, ApeChain announced plans on November 4 to migrate APE, USDC, and other ecosystem assets from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol.

The migration announcement preceded the public warnings about the Reth vulnerability and concerned ApeChain’s existing cross-chain infrastructure.

For operators running affected Reth-based software, the available updates address the state calculation problem, with Base specifically recommending version 1.5.3 and BNB Chain continuing work on its BSC-Reth hotfix.