try http://allchains.info for that data.

I'm inclined to agree. The bitparking I0Coin exchange stopped accepting blocks last night when it detected a chain reorg going back 10 blocks, past the 10 confirmations required for a deposit. So even with 90 second blocks, 10 wasn't enough. That chain only has half the hash rate of GG though.

Someone tried rewriting the block chain 10 blocks back, which is the number of confirmations the exchange waits for deposits. The exchange has locked the block chain down automatically. I'm looking into it.

I agreed that it would be good to start early and was willing to do so as long as the namebit people were involved and the time traveling attack was fixed. This is what I sent in an email to someone who contacted me about it:

I never heard back from vinced so did not update to the new block number for merged mining.

I'll be enabling a way for people to withdraw their funds soon. I won't be enabling deposit until chain authors fix the existing issues and/or BitcoinEXpress withdraws the threat.

In previous posts BitcoinEXpress has said he would attack other chains. Obviously this puts any exchange on those chains at risk hence my stopping deposits and withdrawals in the meantime. If you outline your so called "checkpoint hopping" exploit and other chain attacks for the chain authors to provide solutions for I can consider re-opening them. In the meantime they'll remained closed until I'm confident that a safe way for people to withdraw the funds is available. If you want them opened quicker I suggest you contact the chain authors to fix them.

In posts on the namecoin forums you've stated that amicable resolutions can be reached and implied that if I open an exchange for the GG chain you wouldn't attack namecoin. You even emailed me personally recently asking me to open a GG exchange. Why would I want to run any exchange with the issues you profess plans to exploit existing?

Sadly it was a necessary step to protect the exchange against the threat until ixcoin/i0coin provides steps to defend against it.

You jest, vinced hardly ever talks to anyone and waits weeks before sending responses. It'd take years to build up enough of a conversation to get a decent grudge going.

Nope, once he hits block 19,200 he can merge mine. This allows him to earn bitcoins and attack namecoin at the same time.

Don't keep them in bitparking. It'll be shutting down all namecoin transactions in a few days or block 19000, whichever comes first. If the attack succeeds all namecoins will be considered lost, the exchange will be closed permanently. If it fails the exchange will reopen for withdrawals. If the network hits 19,200 and there is a reasonable hash rate going then I'll consider reopening trades.

Where did I say I'd ignore you? I'm taking your warning and closing down my exchanges.

Didn't artforz's exploit rely on the geitz method of calculating difficulty adjustments using the times on blocks? I don't think namecoin does this does it?

Notifying exchanges doesn't prevent monetary loss. If the rewrite occurs then the exchange will end up with a different balance of namecoins compared to the balance held in the exchange database. Loss will occur due to the exchange losing the coins but still having the users balance reflect what they originally deposited. Even adjusting for the blockchain reorganization the exchange loses in time and effort to fix up transactions and deal with irate users who have lost coins.

The only way for an exchange to avoid this is to close.

It looks like there are none.

Thanks, I've disabled trading in the meantime since I currently have poor network connectivity due to traveling which makes it difficult to fix issues. One thing to test would be to withdraw namecoins from the exchange and try to reverse it.

It's interesting but the difficulty/mining issue that ArtForZ found makes me wary of running any exchange or pool. Has that been fixed?

I don't know if he's disappeared but just wanted to comment on the above. My exchange had over 350,000 SC at shutdown. I assume moonco.in got a fair few of those. It'd be interesting to know how many SC's are out of circulation while its down.

I have shutdown the namecoin exchange while this attack is in process. I'll bring it up shortly with trading disabled to enable withdrawal of funds and reduce the danger of double spend issues.

No bounty needed, thanks for using the exchange in the past

MrMoon, how many confirmations do you wait for for deposits? Your site says one but one confirmation seems pretty dangerous since it makes it much easier for a double spend to occur. Note that this is not intended as an attack on your site, it's a genuine question and suggestion to make it safer.