FLUX
ERGOClaims & Box Safety Tools
Check your FLUX claim, verify box safety, detect sweep history, see what's coming due, and read the full story.
FLUXERGOCheck your FLUX claim, verify box safety, detect sweep history, see what's coming due, and read the full story.
At 22:57 UTC on September 21, 2026, the Flux bridge reserve on Ergo held 415,000,000 FLUX — 94.3% of all Flux on the chain. Three minutes and twenty-seven seconds later, it held nothing.
No private key was stolen. No signature was forged. No bug was exploited. Ergo's protocol simply permits strangers to take dormant funds — and ten blocks after our reserve became eligible, automated collectors did.
Verify the transactions yourself:
tx bb3607fa ·
tx bafedb4a —
inspect them. spendingProof: null on our boxes. The only signed input belongs to the collector,
funding the transaction from their own wallet.
On Ergo, any unspent box that sits unmoved for four years (1,051,200 blocks) can be claimed by anyone, without the owner's key, if it holds too little ERG to cover the ~0.1 ERG storage fee. The claimant keeps the entire box — ERG, tokens, NFTs, everything.
Wallet software routinely attaches the protocol minimum (0.001 ERG) to token transfers. Every such box is born with a four-year fuse. Almost nobody knows.
The same night, the same collectors swept one of our 1 ERG boxes. It could pay its rent — so the protocol forced 0.90125 ERG back to our own script and let them keep ~0.099.
Same mechanism. Two outcomes. Decided solely by the ERG balance in the box.
Tokens + dust = confiscated. That is the design.
Since our reserve was taken, we audited the entire Ergo chain. In just seven days (September 15–22, 2026), two professional collector operations executed:
In 30 days, the same two operators claimed 42,433 boxes from 5,402 addresses — 6,300 boxes confiscated outright including tokens and 286 ERG. Roughly 3,600 ERG in rent was levied on funded boxes. 458 distinct tokens were affected, including:
Of the boxes reaching eligibility, 100% were claimed within 24 hours. In our audit of all 90,490 boxes that have ever held FLUX, not a single unspent box older than the four-year threshold exists. The largest collector operation alone has executed 77,532 transactions in its lifetime.
Destruction is a bug; harvesting is an industry.
The operators of the collection scripts returned the bridge reserve in full within 24 hours —
the bulk back at the bridge roughly eight hours after the drain (txs
6885dd25, 04ea4144, b8b51db2 — all verified on-chain).
We granted them a 100,000 FLUX (main chain) critical bug bounty for the responsible disclosure
and return.
A protocol-legal action, recognized by everyone involved — collectors included — as a critical defect, is the strongest confirmation of the problem.
Flux's published roadmap (runonflux.com) already scheduled consolidating parallel assets and becoming the infrastructure layer on which agents deploy — this decision simply expedites that timeline. From October onward, dormant FLUX boxes become claimable by strangers (7.6M FLUX becomes eligible within 30 days alone). We will not hold users' funds on a chain with a built-in timer, period.
To every Ergo holder on any wallet: consolidate aging boxes, keep at least 1 ERG on every token box, and treat the four-year mark as the hard deadline it is.
We didn't just document the problem. We submitted a complete protocol fix and built the tools the chain lacks:
We call on Ergo's leadership, core developers, miners, and community:
Our criticism is of a design, not of people. We thank the Ergo team for notifying us and working with us closely throughout.
Until it ships, we do not consider Ergo safe for token custody at global scale — for our users, or for anyone's.