Ethereum Classic suffered from three 51% attacks in August this year, throwing the blockchain’s survival into question
The Ethereum Classic (ETC) network suffered from three major 51% attacks last month, the first of which resulted in the loss of approximately US$5.6 million, reigniting the conversation around such attacks and their implications on blockchain.
A 51% attack refers to an attack on a Proof-of-Work (PoW) blockchain where an attacker or a group of attackers gain control of 51% or more of the computing power or hash rate.
PoW is a system of consensus used by blockchains to validate transactions. These transactions are recorded on a distributed ledger, or blockchain, and are confirmed and arranged in blocks in chronological order by miners, to prevent the double spending of cryptocurrencies.
In the mining process, a group of people, referred to as miners, use powerful computers to run complex calculations in order to solve an equation generated by the system, whose level of difficulty increases in proportion to the hash rate, or the rate at which computers are trying to guess the solution to the system’s equation.
The greater a miner’s computing power, the more likely they are to solve the equation. The miner who solves the equation acts as the auditor who confirms the transactions and arranges them in a block, so that these transactions become irreversible.
Therefore, if attackers gain control of the majority of computing power on a blockchain, they can solve the equations faster than other miners and consequently, reverse past transactions that need to be confirmed and double-spend the coins, and prevent new transactions from being confirmed.
Since attackers can manipulate transactions that are awaiting confirmation, they can use the same cryptocurrencies multiple times as if the previous transactions hadn’t taken place, since they control which transactions get confirmed.
For instance, let’s assume an attacker spends 10 bitcoins to buy a product. If the attacker cancels this transaction before it is confirmed, the 10 bitcoins revert back to their account, which they can then reuse to make multiple purchases using the same technique.
In some instances, attackers also build competing blockchains that allow them to spend the same coins twice.
In addition to gains made from double-spending, attackers also earn a substantial amount from miner rewards, which are offered to compensate miners for their efforts in mining coins and updating the blockchain. Since the attackers create a monopoly on hash power on the network, they keep receiving miner rewards in terms of new coins issued.
The Flaw in Nakamoto’s Democratic Governance Model
Bitcoin was the first blockchain to use PoW consensus system to validate transactions. As the pseudonymous creator of Bitcoin Satoshi Nakamoto outlined in his whitepaper, to maintain the security and integrity of a blockchain, ‘honest nodes’ or miners need to ‘collectively control more CPU power than any cooperating group of attacker nodes.’
Nakamoto created Bitcoin out of frustration and aversion to financial institutions after the Great Financial Crisis. Bitcoin is now the most popular cryptocurrency, with a market cap of over $190 billion at the time of writing. To solve the issue of double-spending, an inherent problem in the peer-to-peer digital currency system, he devised the blockchain mechanism and used PoW as the consensus system.
His motive was simple – to create a digital currency that was not governed or controlled by financial institutions, who currently act as gatekeepers and auditors for fiat currencies. To prevent selective people from assuming power or control over the currency, Nakamoto introduced blockchain technology as a democratic way of maintaining transaction records.
His idea of a decentralized digital currency governed democratically by the people, however, assumed that malicious users would not be able to gain majority control over the hash rate, or that at least a majority of the miners would remain honest, and hence, the currency and blockchain would remain immune to attacks.
Time has revealed the flaw in Nakamoto’s base assumption, with a string of 51% attacks plaguing small blockchains and threatening their survival.
The Cost of 51% Attacks
Although owning 51% of the hash rate of a blockchain can allow attackers to double-spend millions of dollars worth of cryptocurrencies, the resources required to control the computing power necessary for such attacks does not come cheap. Therefore, 51% attacks are comparatively more frequent on smaller blockchains since the computing power required to gain 51% of the hash rate on a big blockchain requires considerably more resources.
For example, the cost to carry out a 51% attack for an hour on Bitcoin’s blockchain, which has a market cap of approximately $184 billion, would require $612,664, while an hour-long 51% attack on Litecoin would require only approximately $17,712. A theoretical list of the costs of undertaking hour-long 51% attacks on different blockchains can be found here.
List of Notable 51% Attacks
Blockchains that have suffered 51% attacks include Ethereum Classic (ETC), Feathercoin (FTC), Bitcoin Gold (BTG), Vertcoin (VTC) and Verge (XVG).
2018 was notably one of the worst years to see 51% attacks, and ultimately attacks in this year netted hackers close to $20 million in profits, according to a report by The Next Web.
ETC Attacks:
Between July 29 and August 1, 2020, a 51% attack took place on the ETC network, which is the original Ethereum blockchain maintained by the group who refused to support the fork that corrected The Dao Hack of 2016.
According to an investigation conducted by Bitquery, within a span of four days, the attacker withdrew 807,000 ETC from an unknown exchange to purchase hash rate from DaggerHashimoto for 17.5 bitcoins (worth approximately $192,000 at the time), which helped the perpetrator to gain majority hash rate on the blockchain.
The attacker went on to mine 4280 blocks over 12 hours, during which time he created several private transactions which were not made publicly available to other miners until the end of the attack.
The lengthy duration of the attack provided the perpetrator with enough time to split the operation into smaller parts to avoid raising suspicion. The attacker then published their transactions, which created a fork in the ETC blockchain.
The attacker got away with 13000 ETC, worth approximately $65,000, in mining rewards alone. Including the double-spending, the attacker made away with a total of $5,650,820, a return of more than 2800%, Bitquery reported.
Within a week of the attack, on August 6, the ETC network encountered a second 51% attack in which over 4,000 blocks on the ETC blockchain were reorganized, creating another fork, according to reports by Bitfly and Binance. The total value of the perpetrator’s haul from this attack is yet to be reported.
In light of these attacks, the deposit and withdrawal confirmation time for ETC was extended to almost two weeks, while ETC Labs, the leading organization behind the ETC network, announced other measures including defensive mining to prevent future 51% attacks.
However, this did not stop the third 51% attack of the month on August 29, which resulted in the reorganization of 7,000 blocks, or two days’ worth of mining, Bitfly reported in a Tweet.
These instances of 51% attacks, however, are not the only ones. The ETC network had fallen prey to similar attacks even earlier this year.
BTG Attacks:
Within a span of 6 hours between January 23 and 24 this year, the BTG network, a hard fork of the BTC network, experienced a 51% attack that led to the attacker double-spending BTG worth $70,000. The estimated cost of the attack was $10,200 for six hours.
This attack was a minor one, however, compared to the 51% attack that was perpetrated between May 16 and 18 of 2018 and was first reported on May 18, 2018 on the Bitcoin Gold forum. The attack resulted in the perpetrator defrauding exchanges including Bittrex, Binance, Bithumb, Bitinka, and Bitfinex, through double spend transactions involving 388,000 BTG, worth approximately $18 million at the time. No users lost money or cryptocurrencies during this exchange-focused attack.
This attack is reportedly the largest 51% attack on one of the biggest public blockchains to date.
XVG Attacks:
Between April 4 and 5 of 2018, a 51% attack on the XVG blockchain (also known as Verge Currency) led to the attacker gaining more than 20 million XVG, worth over $1.1 million at the time.
Curiously, unlike other blockchains, XVG uses a rotation of five mining algorithms, and the attacker gained control of two of them, and exploited a bug in the Verge code to falsify time stamps on blocks, which tricked the network into adding them to the main blockchain. The Verge developers corrected the attack with a hard fork.
Within two months of the attack, a second 51% attack on the network was reported by a Bitcoin forum user. In the second attack, the culprits absconded with approximately 35 million XVG, worth approximately $1.75 million at the time, CCN reported.
VTC Attacks:
Vertcoin is an ASIC-resistant cryptocurrency, meaning that popular mining devices called ASICs are prevented from being deployed to avert mining monopolies.
Ironically, the cryptocurrency dedicated to prevent mining monopolies dealt with multiple 51% attacks between October and December of 2018. According to a blog post by Coinbase Security Engineer Mark Nesbitt, the attackers double-spent close to $100,000 worth of VTC, which resulted from the reorganization of over 300 blocks in the VTC network.
Less than a year later, the network suffered another attack, which led to an additional hard fork in which over 600 blocks were reorganized, explained Vertcoin’s Lead Developer James Lovejoy. The attacker spent approximately 1 BTC to gain the hash rate required to perpetrate the attack, but could not double-spend despite the reorganization of the blocks. This was because Bittrex, the original target of the attack, had disabled its wallet before the reorganized blocks were published.
In both cases, the attackers gained the computing power for the attacks from Nice Hash, according to a report by Bitcoin.com.
Implications of 51% Attacks:
51% attacks on blockchains not only lead to loss of digital assets or cash by cryptocurrency users or exchanges, but also raise questions about blockchain’s reliability, security, and trustworthiness.
Although the attacks do not produce new coins or alter the history of a blockchain, they can cause a severe crisis of confidence among users and miners. Since the attackers can tamper with unconfirmed transactions and blocks, innocent miners run the risk of confirming blocks that are later invalidated by the fork created by the attacker.
Additionally, users run the risk of their transactions not being confirmed or being reversed due to forks introduced by such attacks. This could create a lack of trust in the blockchain and in cryptocurrencies, which lose value after almost every attack.
Moreover, this could also potentially lead to the de-listing of certain cryptocurrencies with questionable security measures from crypto exchanges. For example, BTG was delisted from Bittrex after the BTG team refused to pay damages to the exchange caused by the May 2018 attack.
Tackling 51% Attacks
The cost of attacking blockchains going down due to the increasing and easy availability of computing power that can be rented from cloud-based hash power brokerage platforms like Nice Hash, bad news for larger blockchains. Besides, 3 out of 4 blockchain projects are implemented on the Ethereum platform, indicating that a majority of the blockchains use the PoW consensus model, and are therefore susceptible to 51% attacks.
To prevent future attacks, Ethereum is set to launch Ethereum 2.0 later this year, which will use a ‘Proof of Stake’ model to validate transactions, in which miners are randomly selected to validate transactions and add blocks based on their ‘stake’ or wealth in the network.
Within the PoS system, it is not only more expensive and difficult to gain 51% monopoly over block validation, but it is against the interests of anyone holding majority coins on network to attack it, since a fall in the price of the coins would lead to a depletion of the attacker’s holdings value.
Although the level of security and benefit offered by the two consensus systems has been highly debated over the years, Ethereum Co-founder Vitalik Buterin claims that the ETH network will become more secure and costly to hack than Bitcoin as a result of this transition, Coin Telegrah reported.
As in any burgeoning technology landscape, blockchain and cryptocurrency are experiencing extreme highs and lows. Ethereum 2.0 promises to circumvent the loopholes that hackers have been exploiting, but hackers may then find a new backdoor into the blockchain. It’s a circle with seemingly no end, but if there’s one silver lining to this string of 51% attacks, it’s that hacking has forced meaningful progress in an industry riddled with holes.
Photo by Dan Meyers on Unsplash.
