BNB Smart Chain (BSC) issued a hotfix for its Reth execution client on November 6, 2026, after a vulnerability was identified that could produce incorrect blockchain state‑root values. The flaw, traced to legacy trie code used for organizing blockchain data, was discovered on November 4 and fixed upstream in Reth pull request #28264 the day before the BSC release.

ETH / USD
Source: CoinGecko. Prices are indicative.

Nature of the vulnerability

According to the official BNB Chain announcement, the bug affected certain versions of the Rust‑based Ethereum Harvester Tree (Reth) client, potentially leading to node disagreements, sync failures, and inaccurate state‑root calculations during block verification. While the issue could have resulted in financial loss, no exploitation or fund impact has been reported.

Hotfix details and deployment

The hotfix, labeled BSC‑Reth v0.1.4‑hotfix, was published on the project’s GitHub repository and incorporates the upstream fix from pull request #28264. Release notes state that the update corrects the legacy path handling in Reth, ensuring accurate state‑root computation without requiring a database migration or a hard fork. BNB Chain confirmed the patch does not affect opBNB, its Optimistic Rollup solution.

BNB Chain advises all BSC‑Reth node operators—including validators, MEV builders, full nodes, and sentry nodes—to upgrade to the new version and restart their nodes promptly. The upgrade process does not demand any user‑side changes, and the network remains operational while the fix propagates.

What to watch next

Observers will monitor whether any delayed exploitation attempts emerge and how quickly the upgrade is adopted across the BSC validator set. Further updates from BNB Chain regarding post‑upgrade stability and any additional hardening measures for the trie implementation are also expected.