Cardano has just come through one of the most severe technical incidents in its history – a 14-hour chain split that founder Charles Hoskinson insists was “serious, but not existential.” In a late-November livestream, he walked viewers through Pi Lanningham’s “Poison Piggy – After Action Report,” a detailed post-mortem on what happened on November 21, 2025, and what it means for Cardano’s long-held “no downtime” narrative.
Inside Cardano’s 14-Hour Pig-Chain Meltdown
According to Lanningham, a serialization bug in Cardano’s node implementation created the conditions for a unidirectional soft fork. The issue first surfaced on November 20 on the preview testnet, when a malformed delegation certificate was accepted by some nodes and rejected by others. Older nodes correctly rejected the over-long hash; newer nodes, due to a November 2024 code change, truncated it and treated it as valid. That version skew created two incompatible views of the chain.
“The whole reason the testnet exists is to be a safe space” to find these failures, Hoskinson noted. Under normal circumstances, the bug would have been patched and quietly rolled out. Instead, after the fix was identified and was in the process of being communicated to stake pool operators, a near-identical malformed delegation was submitted to mainnet, this time delegating to RATSRATS – conceptually doubling the ticker of RATS, Hoskinson’s own stake pool.
That transaction split Cardano mainnet into two forks. The stricter fork, running older code that rejected the malformed hash, became the “chicken chain.” The permissive fork that accepted it was christened the “pig chain” or “poison piggy.” From that point, the network entered a race: would the poisoned transaction on the pig chain become immutable before the chicken chain could overtake it?
On impact, Lanningham’s numbers are blunt. Cardano remained live but degraded. Transaction inclusion via robust infrastructure slowed dramatically, with delays of up to roughly 400 seconds and block times on the now-dominant chain stretching to around 16 minutes at their worst. Over the incident window, 846 blocks were produced on the pig chain and around 13,900 on the chicken chain. Out of 14,383 observed transactions, 479 – roughly 3.3 percent – were included only on the discarded pig chain and never appeared on the final canonical history. Most of those, when resubmitted, turned out to be invalid due to expired validity intervals or conflicting inputs.
“This constitutes a serious degradation of service for users, but within expected bounds for a high-nines availability of service,” Lanningham wrote. His bottom-line checklist is terse: “Did the chain continue to make progress? Yes. Was service degraded? Yes. Were funds at risk? Potentially. Did the Cardano network recover under essentially worst case conditions? Yes. Would I have confidence to build my business on top of infrastructure that exhibited this level of robustness? Yes.”
The recovery itself is being held up by Hoskinson as proof of both decentralization and design. A patched node was already available thanks to the testnet incident; overnight, IOG, the Cardano Foundation, Emurgo, Intersect, exchanges and many SPOs coordinated via war-room calls and chat channels to upgrade to the fixed version and to follow the more restrictive chicken chain. There was no protocol-level rollback and no centralized “restart.” As stake migrated, block production on the pig chain slowed, the chicken chain accelerated, and Ouroboros’ probabilistic finality properties ensured that once the healthy fork overtook the poisoned one, nodes on the pig chain automatically switched to the longer, denser chain.
“This is the concrete evidence of when the Nakamoto consensus worked as intended and converged the network to a single canonical history,” Lanningham argued. Hoskinson went further, saying, “This could have killed other chains,” but here “time works differently in a distributed system” and effectively stretched the rollback window in Cardano’s favor.
Lessons Learned
Both, however, are clear about the downside. “The fact the bug appeared at all is a failure of our testing rigor,” Lanningham conceded. The reliance of almost all explorers on cardano-db-sync left the ecosystem “flying blind” when that component crashed on the malformed transaction. Many SPOs likely upgraded “blind,” trusting recommendations from founding entities rather than reasoning independently about fork choice. And certain off-chain systems – especially exchanges and bridges – were exposed to replay and double-spend risk, even if early evidence suggests real losses are unlikely.
The post-mortem thus doubles as a roadmap. Lanningham calls for stronger fuzzing and spec-driven testing, richer node-to-client protocols so wallets and exchanges can implement circuit breakers based on real consensus health, more diversity in monitoring stacks, and better education for SPOs on how Ouroboros behaves under stress. Hoskinson, for his part, floated the idea of an AI “upgrade sentinel” for operators and revived demands for a built-in pub/sub channel for emergency alerts.
For the broader narrative war, Lanningham’s position is deliberately dispassionate: “If, after that, you decide for yourself that Cardano ‘went down’, I won’t begrudge you your opinion. I’m not precious about that label… What matters is impact.” Hoskinson is less diplomatic, dismissing most social-media commentary as noise. What he wants the industry to take away is simpler: on November 24, 2025, after Poison Piggy, Cardano is back to one chain – and its next iteration of hardening has already begun.
At press time, ADA traded at $0.4141.
Related Posts
