The v1.0.26 hardfork is now live on Core mainnet and the reward issuance issue is resolved.
The upgrade closed the vulnerability and burned 150M+ CORE of excess issuance, removing it from supply permanently. No transactions were rolled back and no user funds were lost. We expect staking rewards to return to normal within 48 hours. A full post-mortem will follow.
Update: the issue is contained and the malicious validators can no longer draw excess rewards.
We're now coordinating an emergency hardfork with validators to deploy the permanent fix. This is a forward upgrade, not a rollback.
Assets remain safe. Full post-mortem to follow.