Decred has rolled out a mandatory software update, v2.1.6, to address a critical consensus vulnerability, a potential periodic deanonymization attack on its transaction mixing system, and several network denial-of-service risks. The project urged all users to upgrade immediately, warning that those remaining on older versions risk being forked from the network.

The patch applies to dcrd, Decred's full-node software, with accompanying changes for dcrwallet. According to the release notes, the update includes 23 commits from three contributors—Dave Collins, Jamie Holdstock, and Josh Rickmar—spanning 20 files, adding 795 lines and removing 392. The consensus issue is classified as critical, and the project stressed that individual stakeholders, Voting Service Providers, proof-of-work miners, and exchanges running network infrastructure must upgrade to avoid operating on a different fork.

Wallet fixes target mixing deanonymization

A separate set of fixes in dcrwallet v2.1.6 directly addresses Decred's mixing system, which uses CoinShuffle++ (CSPP). The wallet update modifies the mixclient protocol to prevent a deanonymization attack and raises the pairing version for session compatibility. As a result, wallets running v2.1.6 will not mix with older versions, and vice versa, making the upgrade mandatory for all dcrwallet users. Developers also corrected a blame-assignment flaw where mixing peers that incorrectly initiated blame could escape being blamed, and fixed removal of messages from the mixpool after session expiry.

CoinShuffle++ has been live on Decred mainnet since August 2019, according to project documentation. It anonymizes output addresses by combining participants in a mixing process while handling change separately to reduce links between mixed and unmixed outputs. The protocol also supports anonymizing outputs from split transactions before they are used for ticket purchases.

SPV and network protections strengthened

Beyond mixing, dcrwallet v2.1.6 introduces additional validation checks. The wallet now refuses to record a transaction when signature verification fails for spent outputs belonging to the wallet. Simplified Payment Verification (SPV) peers that announce transactions with inputs spending wallet-owned outputs but failing signature-script verification will be disconnected. The update also adds missing Merkle-root validation for blocks processed in SPV mode, a key safeguard for lightweight clients. These changes complement the network-level DoS fixes in dcrd v2.1.6.

Decred's release notes do not indicate that the identified attack routes were exploited in the wild before the patch was published. The project has not disclosed technical details that would provide a step-by-step exploitation route, but emphasized the need for all network participants to move to the patched version.

At the time of the announcement, the Windows build of Decrediton was not yet available, but the project said it expected the release within a day. The current v2.1.6 GitHub page now lists Windows, Linux, and macOS packages. Users can verify release files against SHA-256 hashes and associated signature files provided with the package.

Decred's privacy features have kept it in discussions around privacy-focused crypto assets. A May 2026 privacy coin ETF analysis from crypto.news noted Decred's shielded transaction functionality. During a January 2026 privacy token rally, DCR gained about 60% in seven days. Exchange treatment has varied; Binance reversed plans in 2023 to remove several privacy-related cryptocurrencies in parts of Europe, leaving Decred available in France, Italy, Poland, and Spain, though restrictions continued for other assets.