On Ergo, a box that hasn't moved in about four years can be spent by anyone, without the owner's key. If that box holds too little ERG to pay the network's storage rent — under about 0.15 ERG — the claimant keeps everything inside it, tokens included. The fix is simple: keep at least 1 ERG in every box that holds a token.
In plain English
Ergo, like Bitcoin, doesn't track account balances the way a bank does. Every coin and token you hold sits inside a discrete "box" — a UTXO model like Bitcoin's, with boxes that can carry tokens alongside ERG. Each box has an ERG value, an optional set of tokens, and a guarding script that normally only your key can satisfy.
Ergo adds one rule Bitcoin doesn't have: storage rent. A box that sits unmoved for 1,051,200 blocks — roughly four years at Ergo's roughly two-minute block time — becomes claimable by anyone. The guarding script isn't evaluated for a rent claim, and the input that spends the claimed box carries no signature at all — its spending proof is empty. The only signature in the transaction is the collector's, on their own funding input. It doesn't matter who holds the private key that normally controls the box.
What happens next depends on how much ERG is in the box:
| Box condition | What happens |
|---|---|
| Holds at least about 0.15 ERG | The protocol forces the box back to the owner's own script, minus the rent — roughly 0.1 ERG in the claims Flux observed; the charge depends on the box's size. Tokens stay with the owner. |
| Holds less than about 0.15 ERG | The box can't pay. The claimant keeps the entire box: the ERG, the tokens, the NFTs, everything in it. |
That second row is the one that matters for anyone holding tokens rather than coins on Ergo.
How a claim works (and why it isn't a hack)
Rent collection has been technically possible since block 1,051,200, reached on July 20, 2023, per Ergo's own documentation. It is described in the whitepaper and in that documentation — it has never been hidden. A rent claim uses no exploit and no compromised key: it is Ergo working exactly as designed. Calling it a hack or a breach misdescribes what happens on-chain.
The part that makes it a live risk for token holders is more mundane: wallet software on Ergo has routinely attached 0.001 ERG to token transfers — a widely used default in Ergo wallet libraries. Every box built that way falls straight into the "can't pay" branch above. Each one is, in effect, a four-year fuse: fine for years, and then claimable in a single transaction.
Collectors are not opportunists checking manually. They run automated software that watches for boxes crossing the four-year line and claims them within minutes. In the 30 days to late September 2026, the median time between a box becoming claimable and being claimed was about six minutes.
Case study: the Flux bridge reserve
The clearest illustration is what happened to Flux's own Ergo bridge reserve. Two boxes created on August 30, 2022 held the reserve: one with 400,000,000 FLUX, one with 15,000,000 FLUX. Both carried only the standard 0.001 ERG.
At 23:00:58 UTC on September 21, 2026, a transaction claimed the 400 million FLUX box. Eighteen minutes later, a second transaction took the remaining 15 million. The larger box became claimable at Ergo block 1,878,283 and was claimed at block 1,878,293 — ten blocks, roughly twenty minutes, later. No private key was compromised, and no user funds were lost; the reserve, not user balances, was affected.
Flux reports that the operators who claimed the boxes returned the entire reserve within 24 hours, the bulk of it about eight hours after the drain. Flux granted them a 100,000 FLUX critical bug bounty for the responsible disclosure and the return, and thanked them and the Ergo team for the immediate notification. As a control case the same night, a 1 ERG bridge box from the same period could pay its rent — it came back to Flux's own script as 0.90125 ERG, with roughly 0.099 ERG kept as rent. That's the outcome a properly funded box gets. The two claiming transactions are public: bb3607fa… and bafedb4a…. Full details are in Flux's write-up of the incident; Zelcore's own announcement is covered in Flux ends on Ergo.
The reserve wasn't an isolated case. In the 30 days to late September 2026, two principal collector operations claimed 42,433 boxes from 5,402 addresses; most could pay and came back minus rent, but 6,300 could not and were taken whole; 3,257 of them held tokens, spanning 458 distinct tokens — among them the SigUSD stablecoin, wrapped assets, staking keys and NFTs. Looking ahead, boxes created between September and December 2022 are now reaching their own four-year mark, and Flux estimates that, at the observed rate of 1,400 to 1,850 boxes a day, on the order of 130,000 to 170,000 boxes will be claimed across Ergo in the three months from late September 2026.
How to protect yourself
Whatever wallet you use for Ergo or Ergo-based tokens, the same handful of steps apply — part of the wider self-custody habit of knowing what your wallet does on your behalf:
- Check your address. ergo.runonflux.com is a free box-safety checker with per-box countdowns — no wallet connection or sign-up required.
- Consolidate aging token boxes. Moving older, thinly funded token boxes into one properly funded box creates a new box, so its four-year clock starts again.
- Keep at least 1 ERG on every token box. That is decades of rent coverage instead of a four-year fuse.
- Treat the four-year mark as a deadline, not a guideline. Any box more than about three years old holding less than 0.15 ERG should be assumed scheduled for a claim.
In Zelcore
In the Zelcore release shipping at the end of September 2026, Ergo tokens will be handled differently on desktop, mobile and the browser extension. Until that release reaches you, check your addresses at ergo.runonflux.com rather than waiting for the in-app check:
- 1 ERG on every Ergo token transfer, instead of 0.001 ERG. The 1 ERG goes to the recipient along with the token, so the box they receive has decades of rent coverage instead of a four-year fuse. If the wallet doesn't hold 1 ERG plus the network fee, Zelcore will say how much ERG is missing when you press send.
- A tokens-at-risk check at every login. Zelcore will check the Ergo address of each wallet that has Ergo activated and, if a token box will become claimable within a year (or already is), show a dialog listing the affected wallets, tokens, and estimated dates. It reappears at every login until the tokens are secured.
- Secure my tokens, a one-action fix per wallet: a self-transfer that merges under-funded token boxes into a single box carrying at least 1 ERG, sent back to the same wallet. The ERG stays yours — it costs only the network fee — and you confirm it with an acknowledgement (plus d2FA, if enabled). The row shows that it is waiting for the network to confirm.
- A plain-words explanation on the send screen for every Ergo asset, linking back to the full announcement.
What is being done at protocol level
Flux has submitted EIP-0049, a proposal for prepaid storage rent with archival and revival: rent would drain continuously per block, and an exhausted box would be archived rather than confiscated, with the owner able to revive it later. It's a proposal under discussion, not an adopted protocol change.
Key takeaways
- On Ergo, any box unmoved for about four years (1,051,200 blocks) becomes spendable by anyone, without the owner's key or signature.
- A box holding at least about 0.15 ERG gets forced back to its owner, minus roughly 0.1 ERG rent; a box holding less loses everything inside it.
- The common cause is the 0.001 ERG default that many wallets, including Zelcore until this release, have long attached to token sends.
- Claims are automated and fast — a median of about six minutes from eligibility to claim — so waiting until a box is close to four years old isn't a safe margin.
- Check any Ergo address at ergo.runonflux.com, consolidate old token boxes, and keep at least 1 ERG on every box; from the end-of-September release, Zelcore's "Secure my tokens" action does this in one step.
