A critical bug in GoBalance, a tool used by many dark-web sites for resilience, allows attackers to recover the secret key controlling a site’s .onion address using only public information. This flaw enables an attacker to hijack the .onion address and redirect visitors to a controlled, malicious copy of the site. The discovery by Searchlight Cyber exposes a significant vulnerability in the infrastructure supporting dark-web anonymity and could lead to widespread impersonation and fraud.