If you hold funds in AnomaPay, the practical question is whether those deposits are still intact and when you can reach them again.
On November 11, 2026, at 17:44 (UTC+8), TechFlow reported that AnomaPay had disclosed an external security vulnerability in the RISC Zero proof system it uses. AnomaPay said the flaw may put user funds at risk. The report does not give a confirmed loss amount; the exposure is described as a possibility, not a measured theft.
To protect users, the risc0 verifier behind Anoma was paused, and the RISC Zero team was to upgrade it. AnomaPay said deposited funds are safe, but they stay inaccessible until the Anoma protocol is upgraded to a V2 release that includes RISC Zero’s new security update. That upgrade was expected to take about two weeks. AnomaPay said users do not need to take any action: once the upgrade is finished, funds are to migrate automatically to V2 and access should be restored.
The trade-off is access versus protection. Pausing the verifier blocks normal use of deposits for a time, which AnomaPay presented as a way to limit exposure while the proof system is updated. “Funds are safe” is AnomaPay’s statement. The same notice still treats the flaw as something that may endanger funds, and the report does not independently confirm balances or describe how the vulnerability could be used.
What the notice supports is waiting for the stated V2 upgrade rather than trying to move funds yourself. It does not describe backup, seed, or balance checks holders can run during the pause, and it does not say that the pause removes every risk.
Original report: TechFlow, November 11, 2026.
