Maximum Response of the Team
To avoid the unauthorised further transfers, the core team blocked the payment request option. Therefore, users are no longer able to accept incoming payment prompts. The incident was recognized as a social engineering attack, instead of a protocol failure. Therefore, hackers used fake payment requests rather than attacking the system vulnerabilities.
Fraudsters tracked the wallet balances of people on the blockchain to identify accounts with large amounts of Pi tokens. Also, they forwarded payment requests which looked normal or credible.
After the request was accepted by a user, the transfer was carried out instantly. In addition, this technique enabled the attackers to empty wallets without raising a technical security alert.
Most stolen tokens tracked by blockchain went into one wallet address, according to blockchain tracking data. Importantly, the wallet has been getting between 700,000 and 800,000 Pi tokens every month since July 2025. Transactional information showed that transfers in December had dramatically increased. This, therefore, in the opinion of the analysts, increased the operation as more users became transfer eligible.
Community Alerts Issued
Pi community moderators cautioned members against all unsolicited payments. Besides, they recommended verification by official means before authorising any wallet operation. Further examination indicates that the attackers spread stolen tokens on multiple wallets. Therefore, this method made tracking difficult and obscured the source of transactions.
One of the wallets found was marked by a Pi Network moderator as part of previous account unlocking scams. Also, it is reported that several addresses are coordinated. The freeze of payments comes after the recent network security improvements. It is noteworthy that Pi recently proposed two-factor authentication of mainnet wallet migrations in earlier years.
Its network further enhances its infrastructure as the network freeze progresses. Additionally, newer releases made the mainnet migration more efficient and enhanced verification. Pi Network added automated checks of identity in recent releases. Importantly, the changes were able to cut down manual reviews by half.
Node Software Improvements
The Pi Node supports the 0.5.4 update enhanced the performance of the desktop. Also, developers addressed the issue of the accuracy of calculating the rewards. The team also monitors wallet activity even when the suspension occurs. Therefore, the payment requests will not be activated until further security measures are implemented.
