Network Attack on XVG / VERGE

[Dogedarkdev]

we are not doing a rollback and we are preparing a fork to patch this up.

Sorry to mess up this thread and topic a bit, but after i do not get for hours an answer on twitter, neither does the email function on the Verge homepage work, nor does someone respond on the Verge Bitcoin thread i have to try my luck here.

I visited some hours ago the official Verge Twitter profil to read the news about the hash hack. While reading the tweed i noticed several messages offering a compensation for the attack by Verge. Send x Eth and you get some bonus back. Sounded legit to me as it was affilated to the hash attack and i suffered from it as well having had some hours only orphaned blocks on all my baikals, hence i fall victim to this damn scam on the official twitter page.

Now, while i have myself for sure some vault for this i'am seriously angry about how on the official verge twitter page 100s of scams and fake messages that say they got the ETH back are tolerated and nobody cares about it?!?! How is this possible. After i realized i got scammed i even made a post in this tweet that its a scam and to remove it asap, nothing happened and people still fall after that scam. Only on that scam by now 12+ Eth have been transfered the last hours.

Damn, i'am not a twitter guy and very rarely use it, but from an official Verge twitter profil i personal await its clean and at very least if this for some reason is not possible that there are warning messages about these scams!!!! But no, nothing, the whole official Verge Twitter profil is FULL of scams that are tolerated and people like me, fall victims to it. Fine, i lost some 1.8 ETH, but hourly these scams seems to collect a huge amount of ETH that way and nobody there at Verge cares?

Seriously, so far i wondered about the twitter decision to ban crypto, but i begin to understand the decision. They must get shitload of complains from victims like me.....

And what makes me even more angry ... no response:
- Messaged some hours ago verge on twitter .... nothing, scams are staying and getting more and more
- Put a tweet on the Verge tweet to remove the scams .... nothing, scams are just staying there
- posted in the official bitcointalk Verge thread, nothing ......
- tried to email Verge about the ongoing scams .... email function on the homepage isn't even working, it just loads forever. And after 5 attempts to load it still loads after 2 hours, lol.

I'am writting this as a XVG miner and lover, but this all makes me really sad and angry .....

not sure if you thought we had the ability to delete them, but we dont. we have written to twitter about this. it's happening to all major coins right now. =\

[1713588695]

1713588695

[1713588695]

1713588695

[1713588695]

1713588695

[1713588695]

1713588695

[boxalex]

we are not doing a rollback and we are preparing a fork to patch this up.

Sorry to mess up this thread and topic a bit, but after i do not get for hours an answer on twitter, neither does the email function on the Verge homepage work, nor does someone respond on the Verge Bitcoin thread i have to try my luck here.

I visited some hours ago the official Verge Twitter profil to read the news about the hash hack. While reading the tweed i noticed several messages offering a compensation for the attack by Verge. Send x Eth and you get some bonus back. Sounded legit to me as it was affilated to the hash attack and i suffered from it as well having had some hours only orphaned blocks on all my baikals, hence i fall victim to this damn scam on the official twitter page.

Now, while i have myself for sure some vault for this i'am seriously angry about how on the official verge twitter page 100s of scams and fake messages that say they got the ETH back are tolerated and nobody cares about it?!?! How is this possible. After i realized i got scammed i even made a post in this tweet that its a scam and to remove it asap, nothing happened and people still fall after that scam. Only on that scam by now 12+ Eth have been transfered the last hours.

Damn, i'am not a twitter guy and very rarely use it, but from an official Verge twitter profil i personal await its clean and at very least if this for some reason is not possible that there are warning messages about these scams!!!! But no, nothing, the whole official Verge Twitter profil is FULL of scams that are tolerated and people like me, fall victims to it. Fine, i lost some 1.8 ETH, but hourly these scams seems to collect a huge amount of ETH that way and nobody there at Verge cares?

Seriously, so far i wondered about the twitter decision to ban crypto, but i begin to understand the decision. They must get shitload of complains from victims like me.....

And what makes me even more angry ... no response:
- Messaged some hours ago verge on twitter .... nothing, scams are staying and getting more and more
- Put a tweet on the Verge tweet to remove the scams .... nothing, scams are just staying there
- posted in the official bitcointalk Verge thread, nothing ......
- tried to email Verge about the ongoing scams .... email function on the homepage isn't even working, it just loads forever. And after 5 attempts to load it still loads after 2 hours, lol.

I'am writting this as a XVG miner and lover, but this all makes me really sad and angry .....

not sure if you thought we had the ability to delete them, but we dont. we have written to twitter about this. it's happening to all major coins right now. =\

I'am not a twitter guy, no idea about other coins or twitter in general, but yes, i thought you can either block, ban or delete such messages as the profil owner.
And as i wrote allready, if it is NOT possible for some reason, why no big warning on top?? I mean it seems you are aware of these 100's of scams on your official Verge profil, but people like me interested in XVG are not.

[stronghandsdeeppockets]

we are not doing a rollback and we are preparing a fork to patch this up.

Sorry to mess up this thread and topic a bit, but after i do not get for hours an answer on twitter, neither does the email function on the Verge homepage work, nor does someone respond on the Verge Bitcoin thread i have to try my luck here.

I visited some hours ago the official Verge Twitter profil to read the news about the hash hack. While reading the tweed i noticed several messages offering a compensation for the attack by Verge. Send x Eth and you get some bonus back. Sounded legit to me as it was affilated to the hash attack and i suffered from it as well having had some hours only orphaned blocks on all my baikals, hence i fall victim to this damn scam on the official twitter page.

Now, while i have myself for sure some vault for this i'am seriously angry about how on the official verge twitter page 100s of scams and fake messages that say they got the ETH back are tolerated and nobody cares about it?!?! How is this possible. After i realized i got scammed i even made a post in this tweet that its a scam and to remove it asap, nothing happened and people still fall after that scam. Only on that scam by now 12+ Eth have been transfered the last hours.

Damn, i'am not a twitter guy and very rarely use it, but from an official Verge twitter profil i personal await its clean and at very least if this for some reason is not possible that there are warning messages about these scams!!!! But no, nothing, the whole official Verge Twitter profil is FULL of scams that are tolerated and people like me, fall victims to it. Fine, i lost some 1.8 ETH, but hourly these scams seems to collect a huge amount of ETH that way and nobody there at Verge cares?

Seriously, so far i wondered about the twitter decision to ban crypto, but i begin to understand the decision. They must get shitload of complains from victims like me.....

And what makes me even more angry ... no response:
- Messaged some hours ago verge on twitter .... nothing, scams are staying and getting more and more
- Put a tweet on the Verge tweet to remove the scams .... nothing, scams are just staying there
- posted in the official bitcointalk Verge thread, nothing ......
- tried to email Verge about the ongoing scams .... email function on the homepage isn't even working, it just loads forever. And after 5 attempts to load it still loads after 2 hours, lol.

I'am writting this as a XVG miner and lover, but this all makes me really sad and angry .....

not sure if you thought we had the ability to delete them, but we dont. we have written to twitter about this. it's happening to all major coins right now. =\

I'am not a twitter guy, no idea about other coins or twitter in general, but yes, i thought you can either block, ban or delete such messages as the profil owner.
And as i wrote allready, if it is NOT possible for some reason, why no big warning on top?? I mean it seems you are aware of these 100's of scams on your official Verge profil, but people like me interested in XVG are not.

nothing can be done, this has happened even with Vitalik, cz and many other important figures. It is up to Twitter to do anything about them (keep in mind there are paid people saying "thank you for X ETH" in order to lure you).

[bluejeanballa]

nice a new version of the famed timewarp attack.. very interesting.

yep.. we pushed a quick fix and most pools have already updated.. we're already working on a whole new block verification process.

we're kinda glad this happened and that it wasn't as bad as it could have been.

Hmm, you guys are aware that the "fix" you pushed actually IS a hardfork ? So your blockchain snapshot is not valid anymore, the wallet's won't sync up from scratch anymore and the current chain is simply not usable anymore with that new "fix" ?

Your change simply disagrees with the attackers blocks, the first block I see from the attacker was 2007365 - so the wallets will stop syncing there and simply not progress any further.

I remember your first forking dramas when trying to fork into Tor which failed 2 times IIRC.

You should immediately refrain from that "fix" and set a proper fork-height (at least 48h) and the chain up until the fork block MUST accept blocks with the old timestamps and blocks after that fork block then only with the new timestamp.

bumping this for awareness

how can we verify the hardfork ?

just download an updated wallet which includes the "fix" - then download the blockchain snapshot and try to sync up to the latest block...it will get stuck at 2007364

Confirmed.    client stalls at block 2007364

yeah we removed that, and we're doing a full fork update with extra block verifications. will be ready by tmrw =]

So are you saying the exploit can be used for the rest of the day with no repercussions?

[ChekaZ]

nice a new version of the famed timewarp attack.. very interesting.

yep.. we pushed a quick fix and most pools have already updated.. we're already working on a whole new block verification process.

we're kinda glad this happened and that it wasn't as bad as it could have been.

Hmm, you guys are aware that the "fix" you pushed actually IS a hardfork ? So your blockchain snapshot is not valid anymore, the wallet's won't sync up from scratch anymore and the current chain is simply not usable anymore with that new "fix" ?

Your change simply disagrees with the attackers blocks, the first block I see from the attacker was 2007365 - so the wallets will stop syncing there and simply not progress any further.

I remember your first forking dramas when trying to fork into Tor which failed 2 times IIRC.

You should immediately refrain from that "fix" and set a proper fork-height (at least 48h) and the chain up until the fork block MUST accept blocks with the old timestamps and blocks after that fork block then only with the new timestamp.

bumping this for awareness

how can we verify the hardfork ?

just download an updated wallet which includes the "fix" - then download the blockchain snapshot and try to sync up to the latest block...it will get stuck at 2007364

Confirmed.    client stalls at block 2007364

yeah we removed that, and we're doing a full fork update with extra block verifications. will be ready by tmrw =]

So are you saying the exploit can be used for the rest of the day with no repercussions?

Sounds great! - That screams for exploit and rollback afterwards.

[ninjaboon]

Just saw this news from my dev. It did not affect the price of XVG that stands at 901 sats.

[ChekaZ]

the attacker just modify the code of his ccminer, only
very clever, very simple, very efficent
about 500'000 XVG to 1'000'000 XVG in a day all validated and confirmed
i'm impressed, shitt

More like 134M verge per day.

[stronghandsdeeppockets]

Just saw this news from my dev. It did not affect the price of XVG that stands at 901 sats.

Censorship. People get banned on Telegram, I personally got banned on their subreddit after my thread got 30 upvotes. Yeah, no shit the price didn't crash, people are denied this piece of information!

https://www.reddit.com/r/vergecurrency/comments/89tbyp/xvg_still_being_exploited_after_fix_by_dev_check/

[Tarlatata]

So are you saying the exploit can be used for the rest of the day with no repercussions?

It does show the serious of the coin doesn't it ?

...

***

A good man walk by a bank and notice someone fleeing with a bag of money.

He tells the guards, the manager and people in the bank that the vault in open and that anyone can steal from it.

"Why are you spreading lie, you scumbag!" do people scream at him.

After a few hours, the manager comes and openly tell people it was a good thing and that they will close the vault tomorrow and that meanwhile, it'll stay open, unguarded and unmonitored for people to keep stealing from it.

****

Yup, that's how things are done when you are one of the Verge executive.

[BlackPrapor]

So are you saying the exploit can be used for the rest of the day with no repercussions?

It does show the serious of the coin doesn't it ?

...

***

A good man walk by a bank and notice someone fleeing with a bag of money.

He tells the guards, the manager and people in the bank that the vault in open and that anyone can steal from it.

"Why are you spreading lie, you scumbag!" do people scream at him.

After a few hours, the manager comes and openly tell people it was a good thing and that they will close the vault tomorrow and that meanwhile, it'll stay open, unguarded and unmonitored for people to keep stealing from it.

****

Yup, that's how things are done when you are one of the Verge executive.

Are you implying that Verge execs are somehow connected to the hack?

[yubit]

Looks like the same attacker made attack on Karbo and other cryptonote-based coins a day ago.
And Karbo team also made a hardfork.

[Gongolo]

That's why I usually trust suprnova.
Really good job.

[Tarlatata]

So are you saying the exploit can be used for the rest of the day with no repercussions?

It does show the serious of the coin doesn't it ?

...

***

A good man walk by a bank and notice someone fleeing with a bag of money.

He tells the guards, the manager and people in the bank that the vault in open and that anyone can steal from it.

"Why are you spreading lie, you scumbag!" do people scream at him.

After a few hours, the manager comes and openly tell people it was a good thing and that they will close the vault tomorrow and that meanwhile, it'll stay open, unguarded and unmonitored for people to keep stealing from it.

****

Yup, that's how things are done when you are one of the Verge executive.

Are you implying that Verge execs are somehow connected to the hack?

Not at all, I'm simply implying that letting the blockchain open to further attack, which allow some to keep stealing money from everyone who owns XVG, would be seen as helping those thieves if done in a real, legistlated financial environment.

It also shows the lack of serious of from a team which coin sees 300 millions$ daily volume. How can you people trust the coin? I know I don't.

[Dogedarkdev]

we're putting out an update, and it will fix it. that's what we can do. it's the best we can do. no, they did not 13 hours of coins. it was some blocks during a 3 hour period.

something around ~250k coins, and the attack probably cost alot more than that, luckily.

we are glad this was brought to our attention, and we are already working on a sophisticated block verification routine.

[stronghandsdeeppockets]

we're putting out an update, and it will fix it. that's what we can do. it's the best we can do. no, they did not 13 hours of coins. it was some blocks during a 3 hour period.

something around ~250k coins, and the attack probably cost alot more than that, luckily.

we are glad this was brought to our attention, and we are already working on a sophisticated block verification routine.

tell your vergin moderators to stop censoring this. Both on Reddit and on Telegram. Pathetic.

[BillionDollarMan]

So are you saying the exploit can be used for the rest of the day with no repercussions?

It does show the serious of the coin doesn't it ?

...

***

A good man walk by a bank and notice someone fleeing with a bag of money.

He tells the guards, the manager and people in the bank that the vault in open and that anyone can steal from it.

"Why are you spreading lie, you scumbag!" do people scream at him.

After a few hours, the manager comes and openly tell people it was a good thing and that they will close the vault tomorrow and that meanwhile, it'll stay open, unguarded and unmonitored for people to keep stealing from it.

****

Yup, that's how things are done when you are one of the Verge executive.

Are you implying that Verge execs are somehow connected to the hack?

He may not be but I am convinced with the timing. Just after the recent begging for donation and partnership hype related pump then something like this gives pretty good excuse not to deliver on promise. Anyway you can continue with XVG moon propaganda, it doesn't harm cryptoworld like other scams such as XRP.

[Dogedarkdev]

we're putting out an update, and it will fix it. that's what we can do. it's the best we can do. no, they did not 13 hours of coins. it was some blocks during a 3 hour period.

something around ~250k coins, and the attack probably cost alot more than that, luckily.

we are glad this was brought to our attention, and we are already working on a sophisticated block verification routine.

tell your vergin moderators to stop censoring this. Both on Reddit and on Telegram. Pathetic.

its already been addressed in both places. we don't need it spammed everywhere, thanks.

[ocminer]

we're putting out an update, and it will fix it. that's what we can do. it's the best we can do. no, they did not 13 hours of coins. it was some blocks during a 3 hour period.

something around ~250k coins, and the attack probably cost alot more than that, luckily.

we are glad this was brought to our attention, and we are already working on a sophisticated block verification routine.

Sorry this is not true, the attack started on block  2007365 and ended on block 2010039 = 2674 blocks, okay lets say 2500 blocks...

One Block makes about 1560 coins, so you have 2500 * 1560 = 3.900.000 "extra" coins generated (at least!) ....

I've listed a few of the attackers addresses in the first post.. Just check them, check the balance and if you're curious, just go through all the blocks during that timespan and sum them up.. It's actually easy when you have a blockexplorer database running.. You can do it via SQL query.

[LinuxDude]

nice a new version of the famed timewarp attack.. very interesting.

yep.. we pushed a quick fix and most pools have already updated.. we're already working on a whole new block verification process.

we're kinda glad this happened and that it wasn't as bad as it could have been.

Hmm, you guys are aware that the "fix" you pushed actually IS a hardfork ? So your blockchain snapshot is not valid anymore, the wallet's won't sync up from scratch anymore and the current chain is simply not usable anymore with that new "fix" ?

Your change simply disagrees with the attackers blocks, the first block I see from the attacker was 2007365 - so the wallets will stop syncing there and simply not progress any further.

I remember your first forking dramas when trying to fork into Tor which failed 2 times IIRC.

You should immediately refrain from that "fix" and set a proper fork-height (at least 48h) and the chain up until the fork block MUST accept blocks with the old timestamps and blocks after that fork block then only with the new timestamp.

bumping this for awareness

how can we verify the hardfork ?

just download an updated wallet which includes the "fix" - then download the blockchain snapshot and try to sync up to the latest block...it will get stuck at 2007364

Confirmed.    client stalls at block 2007364

yeah we removed that, and we're doing a full fork update with extra block verifications. will be ready by tmrw =]

So are you saying the exploit can be used for the rest of the day with no repercussions?

Sounds great! - That screams for exploit and rollback afterwards.

Downloaded latest Wallet, installed blockchain files from 4/3/18 and I got past block 2007364 and it's still syncing for me.

[bluejeanballa]

we're putting out an update, and it will fix it. that's what we can do. it's the best we can do. no, they did not 13 hours of coins. it was some blocks during a 3 hour period.

something around ~250k coins, and the attack probably cost alot more than that, luckily.

we are glad this was brought to our attention, and we are already working on a sophisticated block verification routine.

Looking at the block explorer some of the new blocks are still out of order according to the time stamps. Doesn't that suggest the exploit is still being used? I'm just having a hard time trying to figure out why you believe it only happened for 3 hours. What's to stop the exploit from being used for the rest of the night, therefore stealing more than 250k coins?