We want to make GenLayer Portal users aware of a data security incident and the steps we have taken in response.
On 30 May 2026, we identified that a part of the GenLayer Portal had allowed an unauthorized party to access certain user information. We deployed a fix the same day we identified the issue.
The only non-public information involved was users' email addresses. Other profile information that the incident touched, including wallet addresses and usernames, was already publicly visible on each user's Portal profile and could be viewed by anyone without logging in. The incident allowed those already-public details to be linked to a user's email address.
No passwords, private keys, or seed phrases were stored on the Portal or accessed in this incident.
Because email addresses could be connected to existing public profile information, some of this data was used to send phishing emails impersonating GenLayer, typically claiming you have a reward, XP, or tokens to claim and directing you to a fraudulent website. These particular messages were not from us. The main risk to users is phishing, impersonation, and similar attempts to trick you into giving up access to your wallet. We have no confirmed reports of any user funds being lost.
If you have any questions or want to report a suspicious message, contact us at contact@genlayer.foundation.