Note from Gregory Maxwell on reasons why the alert was delayed--
I made a conscious decision to delay sending out a warning since there were no transaction conflicts and most of the hashpower on the invalid chain was not mining transactions. This was discussed, in public, with the rest of the technical crew that was minding the issue.
Without any conflicts at play yet the fork was harmless, and I thought it was better to gather more information before acting and the rest of the active tech folks seemed to agree. Had conflicts shown up the alert would have gone out immediately.
It was also the case that all versions of Bitcoin Core who would have been on the invalid fork would have been displaying an automatically generated alert due to the presence of 'future' version blocks.
Official Status and recommendations--
https://bitcoin.org/en/alert/2015-07-04-spv-miningome Miners Generating Invalid Blocks
4 July 2015
This document is being updated as new information arrives. Last update: 2015-07-04 09:30 UTC
Summary
Your bitcoins are safe if you received them in transactions confirmed before 2015-07-04 08:00 UTC.
However, there has been a problem with a planned upgrade. For bitcoins received later than the time above, confirmation scores are significantly less reliable then they usually are for users of certain software:
Lightweight (SPV) wallet users should wait an additional 30 confirmations more than you would normally wait.
Bitcoin Core 0.9.4 or earlier users should wait an additional 30 confirmations more than you would normally wait or upgrade to Bitcoin Core 0.10.2.
Web wallet users should wait an additional 30 confirmations more than you would normally wait, unless you know for sure that your wallet is secured by Bitcoin Core 0.9.5 or later.
Bitcoin Core 0.9.5 or later users are unaffected.
Miners
If you pool mine, please switch to a pool that properly validates blocks. (If you solo mine, please switch to Bitcoin Core 0.10.2.)
Bad pools: these pools are not correctly validating, and are losing money.
BTC Nuggets
Good pools: these pools properly validate blocks. Please switch to them, at least until the bad pools have fixed their systems.
Eligius
kano/ckpool
P2Pool
F2Pool
When Will Things Go Back To Normal?
The problem is miners creating invalid blocks. Some software can detect that those blocks are invalid and reject them; other software can't detect that blocks are invalid, so they show confirmations that aren't real.
Bitcoin Core 0.9.5 and later never had any problems because it could detect which blocks were invalid.
Bitcoin Core 0.9.4 and earlier will never provide as much security as later versions of Bitcoin Core because it doesn't know about the additional BIP66 consensus rules. Upgrade is recommended to return to full node security.
Lightweight (SPV) wallets are not safe for less than 30 confirmations until all the major pools switch to full validation.
Web wallets are very diverse in what infrastructure they run and how they handle double spends, so unless you know for sure that they use Bitcoin Core 0.9.5 or later for full validation, you should assume they have the same security as the lightweight wallets described above.
What's Happening
Summary: Some miners are currently generating invalid blocks. Almost all software (besides Bitcoin Core 0.9.5 and later) will accept these invalid blocks under certain conditions. The paragraphs that follow explain the cause more throughly.
For several months, an increasing amount of mining hash rate has been signaling its intent to begin enforcing BIP66 strict DER signatures. As part of the BIP66 rules, once 950 of the last 1,000 blocks were version 3 (v3) blocks, all upgraded miners would reject version 2 (v2) blocks.
Early morning UTC on 4 July 2015, the 950/1000 (95%) threshold was reached. Shortly thereafter, a small miner (part of the non-upgraded 5%) mined an invalid block--as was an expected occurrence. Unfortunately, it turned out that roughly half the network hash rate was mining without fully validating blocks (called SPV mining), and built new blocks on top of that invalid block.
Note that the roughly 50% of the network that was SPV mining had explicitly indicated that they would enforce the BIP66 rules. By not doing so, several large miners have lost over $50,000 dollars worth of mining income so far.
All software that assumes blocks are valid (because invalid blocks cost miners money) is at risk of showing transactions as confirmed when they really aren't. This particularly affects lightweight (SPV) wallets and software such as old versions of Bitcoin Core which have been downgraded to SPV-level security by the new BIP66 consensus rules.
The immediate fix, which is well underway as of this writing, is to get all miners off of SPV mining and back to full validation (at least temporarily). As this progresses, we will reduce our current recommendation of waiting 30 extra confirmations to a lower number.
