I. 2025: Establishing a Foundation for Top-Tier Security Audits
In September 2025, the Conflux network completed a rigorous audit conducted by two internationally renowned security firms, Halborn and Least Authority. The audit report has been published on the official GitHub repository. This initiative is intended to strengthen the network’s security resilience, providing developers and organizations with a safe and reliable infrastructure foundation.
II. 2026: Security Exposure and Rapid Response
May: v3.0.3 testnet emergency patch
In May 2026, Conflux released the v3.0.3 testnet upgrade, aimed at fixing a critical security vulnerability that could cause nodes to fail in certain situations. The upgrade is recommended, but the official clearly states that un-upgraded nodes may face operational risks. The market reaction was steady.
August: v3.1.0 testnet hard fork
On August 7, 2026, Conflux plans to launch the v3.1.0 testnet hard fork, implementing seven CIP improvement proposals, including a security patch (specific details will be disclosed after activation to help prevent exploitation). In addition, CIP-173 fixes the PoS contentious evidence verification issue and expands the staking lock-up mechanism.
III. July: Ecosystem security cooperation with BlockSec
On July 30, 2026, Conflux and blockchain security and compliance company BlockSec announced an ecosystem security cooperation. BlockSec will officially support the Conflux network.
The cooperation covers the entire project lifecycle, including:
Security assessment: conduct systematic code audits before deployment
Address risk screening: identify high-risk addresses
On-chain risk monitoring: continuously monitor key smart contracts and fund addresses
Security incident response: rapid response to abnormal on-chain activity
In addition, the two parties will jointly promote an ecosystem security enablement program, providing support such as technical integration, safe tool usage, and joint market promotion for ecosystem projects with real business scenarios.
IV. External risk rating and ongoing challenges
Independent security rating agency Hindenrank assigns Conflux an overall risk score of 32/100 (B- tier), ranking 26th among 56 L1 protocols, slightly better than the industry average of 35/100. Key risk points include a high dependence on regulatory policies (6/10), still limited production validation time for the tree-graph consensus mechanism, and an above-average share of internal personnel in token distribution (52%). The ZARQ rating is Baa1 (60.8/100), with a crash probability of 18%, which is in the "WATCH" observation category.
In addition, Conflux previously released a security alert in 2026 involving phishing attacks impersonating official accounts, reminding users to be wary of suspicious links and emphasizing that the official will never request private keys or wallet information via direct messages.
V. Summary
Conflux’s security framework is shifting from "passive patching" to "active defense and ecosystem co-building": it has external endorsements from top audit firms such as Halborn and Least Authority, as well as full-lifecycle dynamic monitoring provided by BlockSec, enabling rapid response when vulnerabilities are discovered. However, its unique regulatory positioning and a relatively new consensus mechanism remain factors that external rating agencies continue to关注.
Source of materials: official media / online news. This content is for reference, learning, and communication only. Please strictly comply with the laws and regulations in your jurisdiction. This article does not constitute any investment advice.