If you had funds with AnomaPay, the holding question in this notice was simple: were the assets still described as yours while you could not move them?
On 11 November 2026, PANews reported that AnomaPay had said on X that it found an external security vulnerability in the RISC Zero proof system it uses, and that the flaw could put user funds at risk. AnomaPay said that, to protect users, the risc0 verifier behind Anoma had been paused and would be upgraded by the RISC Zero team.
AnomaPay said funds already deposited were safe. It also said those funds would stay temporarily inaccessible until the Anoma protocol was upgraded to a V2 release that includes RISC Zero’s new security update. The upgrade was expected to take about two weeks. AnomaPay described the downtime as undesirable, but necessary to protect user funds.
That is an accessibility trade-off, not a statement about key confidentiality or backup redundancy. Deposits were described as intact, yet unavailable for the length of the upgrade. AnomaPay said users did not need to do anything. After the upgrade, funds were to be migrated automatically to V2, with access restored. The notice does not ask anyone to export keys, sign a transaction, or send funds elsewhere.
No confirmed loss figure appears in the report. The risk is stated as possible, and the claim that deposited funds were safe is AnomaPay’s, as relayed by PANews. A paused verifier and a planned automatic migration do not remove every custody risk; they only describe the steps AnomaPay said it was taking as of that report.
Original report: PANews, 11 November 2026, 17:43 (UTC+8).
