Bitcoin Forum

Ethereum Classic Attacker Successfully Double-Spends $1.68M in Second Attack

Ethereum Classic’s second 51% attack Thursday resulted in a massive reorganization of 4,236 blocks and successful double-spend of $1.68 million worth of cryptocurrency, according to an investigation by Bitquery.

The attacker tried to double-spend 465,444 ethereum classic (ETC), worth approximately $3.3 million, but only successfully double-spent 238,306 ETC, worth $1.68 million, according to the report.

An additional 14,200 ETC were also claimed by the attacker via block rewards during the event.
Bitquery found the hashpower required for the attack was probably bought from the same source as for the first attack: Nicehash DaggerHashimoto.

Thursday's attack is the second on the Ethereum Classic platform within five days. The first attack occurred on Aug. 1 and was originally thought to be the result of software complications.
Ethereum Classic Labs, the core development organization behind Ethereum Classic, announced Friday that it has retained law firm Kobre & Kim to investigate and pursue criminal charges against the perpetrators of
both 51% attacks, according to a press release shared with CoinDesk.

https://www.coindesk.com/ethereum-classic-attacker-successfully-double-spends-1-68m-in-second-attack-report

This is the problem now with  cryptocurrency with these hackers around the crypto funds are not safe anymore. Besides, we do not really know who are these guys or they are related with the team. Who knows these could be also an inside job and there is related law that could protect consmer against these hackers. The hackers are freely to do what they wanted without even getting into prison for every country has different interpretation and could.not affect the exisiting law of the country where the hackers live.

It was a matter of time when this happens and I hope that all of us have lessons learned and won´t keep our investments in PoW coins with declining hashing power like all BTC or ETH forks. They are not supported, used or developed, it only takes your opportunity of having a real BTC and ETH.  8)

ETC has been plague with history of 51% attack and I don't know how the devs are not working to fix it. And I think they should have learned from this attack and should have done something to prevent it. But no one cares, so the attackers did it again the second time to double spend and create another chain. Good thing that the price hasn't been affected negatively, but still if I'm a ETC investors, I will have doubts and probably move out my coins.

It is very sad that there are people who still believe with those BTC forks and think that it will last a lifetime.

They don't know that the same attack in ETC can happen if they will remain on those BTC forks because it is unsafe. I hope that someday they will realize and have a sense of thought that they should keep themselves away from it and just go with the real BTC.

i guess some of the investors already cash out their holdings because of this. if they can't fix this, the chance that it will happen again is always there. should not wait when their investors totally lost their trust to this project. the attackers will always try and try again, as they know the vulnerability of the network.

It's very strange to think that for a cryptocurrency to be successful it needs to suffer a hackers attack and looking back to the past, major projects have suffered this type of attack. The system security vulnerability is the main gateway and why don't developers focus on security? The question is how to invest in a project with a security breach?

Suffering two attacks in one week is extremely horrible. Sad to see that there is no updates about the recent hacks in their official ANN (https://bitcointalk.org/index.php?topic=5134923.0) thread. Offcial team already asked exchanges to require more confirmations for deposits, and miners to pause mining payouts: https://twitter.com/eth_classic/status/1291656720863772672
A proposed solution was also made by an ethereumcommonwealth dev here: https://github.com/ethereumclassic/ECIPs/issues/327
 
That's right. But with ETC the issue is more complicated when we think about all the smart-contracts developped in top of ETC and stucked with the repetitive hacks. Not like traders or holders, it's not easy to get a step back.

You misunderstand the nature of 51% attack, it's not a security bug, it's how decentralized coins operate. They need to grow big enough to reduce the risk of 51% to a minimum, and those that don't grow can be considered shitcoins just because they are vulnerable to 51% attack. By having many coins with the same alrorithm, a natural selection will take place, because the equipment of the majority coin can be used to attack the smaller coins. This is what happened with ETH Classic and Ethereum, as Ethereum holds nearly all ETHash hashpower.

Wrong, Bitcoin has one time was vulnerable to 51% attack, but the mining pool didn't take advantage of it. It really depends on how miners are security ETC's network, but it seems that the percentage of bad miners is obviously greater because they were able to put this off again in a week.

And remember that ETC is just a fork coin, so it is really vulnerable just like the other forks on Bitcoin. Investors doesn't care, as long as they are making money, they will simply get inside and then exited when they have a good returns.

Ethereum classic team should have learned from the first attack and provide a solution to it quickly so it will never happen again. Thinking that the first attack is because of
software complications is not a good idea, I can see that they are lazy in digging the true reason behind that problem.

And now they are paying the price because the attaker did it again using almost the same method and the same source of hashpower. It will be good if the team can do something
about it and promise their customers that this kind of problem will not happen again.

It seems hypocritical that they want to pursue legal charges against the perpetrator when the whole reason the coin exists is because they disagreed with how the DAO hack was handled. If they really believe that code is law then they should do nothing since this is a normal feature of proof of work. It's not the attackers fault that the coin isn't valuable enough for miners to want to protect that blockchain.

I think this is the second time ETC got 51% attacked this month and this time the loss due to attack was massive. IMO if ETC continues to get attacks like this many exchanges will start delisting ETC.

I've seen this coin being attacked many times already and now they are getting attacked again in short amount of time. They've been attacked I think weeks ago (correct me) and now they've been attacked again.

How would the developers of the project fix this. For sure this will affect the reputation of the coin and a cause of further price downfall. I'm predicting that this will be shitcoin in the future if this will continuously happen.

This upset and incidence would continue to occur as long as the team refuses to implore new safe guild techniques in the project. This is as a result of ignorance on teams thereby would possibly cause a wide downfall of coin price and rather its reputation. In as much crypto project us concerned,major factor its been looked up to the security and privacy aspects, ethereum classic needs that as a backup plan in their project.

Agree, the problem is that more and more hash power is moving from smaller PoW projects (although ETC is not really small) to larger PoW projects. This development can be observed continuously since 2018. The more hash power gives up for the small PoW projects, the cheaper and more frequent 51% attacks will be. So no wonder and every investor should be aware of this.

I cannot understand who still investing in the project. they said that this is the most decentralized project, but in fact, this is no very centrilized. people who believe in this coin will be left without their money

this has happened, Kucoin has done it on their margin trade, I think other exchanges are likely to do the same thing because I think this is a pretty fatal mistake the first attack was fatal for a crypto project, second attacks ? this is severe, but it seems like delisting is a little the best choice.

That is unfortunate and this will put brakes on ethereum classic's development and progress once again.
I think there should be some mechanism to track down such culprits and even if they are not punished the coins(assets) must be returned from them otherwise it is the loyal supporters, investors and hodlers that suffer in the end.

For the second attack ETC team need to take responsibility, how can second attack happens with almost the same attack tactics, the funny thing about it is the team employing legal team to look into it. This is my advice to all these small POW network, change to POS it is not a crime, safety first

I'ts not a security bug? I fully understand your point of view but we must separate the technical point of view and the point of view for application. In this case we have two options that would be an error or a natural historical fault that always damages the project. The theory is complex and this should be considered a security bug because how will the project value with the possibility of an attack? I just analyze the story.

So we are in a historical discussion because we are observing that a project depends completely on miners? From an energy point of view this is correct but does it affect the point of view of security? It's showing that yes. As I mentioned in the comment above, it's a complex topic to be analyzed because we must analyze the chain completely and it has been a while since I observed this type of situation that it seems to be a pattern that for all successful projects is under attack.

From an economic point of view I agree with you.

It isn't the fault of the ETC team, the fault is of the low hashpower of the ETC network due to which the cost of an 51% attack is pretty low and that's the reason why ETC saw the 2nd attack in a span of 5 days. As you said ETC should upgrade their protocol to POS and then these 51% attacks could be solved but if the mining protocol still remains POW then we can see another attack in a few days again. This hurts the community and also the reputation of the coin if these attacks aren't stopped in the beginning by the team.

This explains why POW is not good for small or medium sized coin. And with so much with ETH, it would be better to let it go. There are quite a lot coins that could complement for ETC and the use of energy just for the sake of keeping a coin alive is unjustifiable. Even though it came out of it, we cant be sure the attack wont happen again. As the ETH changes to POS, a lot of miners and mining equipment would be free.

I feel like ETC needs to recover from this a lot more marginally than the last time, they have lived through this once before and people already said that they are out of ETC and will never invest to it by bulks and whoever left right now will have a lot more people who will get out as well.

These days being a project like ETC is difficult because there is no owners, there is no team behind it in the way that ICO's have, they are not funded by the project and that means there will be less work done on it. However, if they do not work on it and get it done and make it in a way that it could NEVER have any more 51% attack no matter who or how they work, even with a quantum computer if it is even possible, they have to do it now, if they do not do it they will be gone.