Ethereum Classic hack nets thieves $1.1 million

Ethereum Classic, the cryptocurrency created after the main Ethereum developers led by Ethereum founder Vitalik Buterin split off in a June 2016 hard fork to reverse the theft of $55 million in coins, suffered another loss this week.

On Jan. 5, a miner or group of miners managed to gain control of more than half of the Ethereum Classic mining power, or hashrate, in what is called a “51% attack.” This gave them the ability to double spend ETC coins—basically spending a newly created coin and then forking the ETC blockchain, allowing them to cancel the transaction and be able to spend that coin again.

Called a deep chain reorganization, or reorg, the attackers were able to steal 219,000 ETC coins valued at $1.1 million in several attacks over four days, according to leading cryptocurrency exchange Coinbase, which spotted the reorg on Jan. 6 and halted trading in ETC as well as sending out an alert. Other exchanges followed suit. As of press time, Coinbase had not fully restarted trading of ETC, currently the 18th-ranked coin by market capitalization, allowing the buying and selling of ETC but not sends and receives. The main Ethereum currency, ETH, was not affected. It is the second-largest cryptocurrency by market cap.

Cryptocurrency exchange Gate.io announced it would reimburse traders for losses of about $200,000.

In a post on Medium, SlowMist, a Chinese blockchain security consulting firm, said that the final attack occurred at 04:30.17 UTC on Jan. 8. The firm, which has been aggressively tracking the attack, said it believes it can track and locate the attacker “if the relevant exchanges are willing to assist.” The post contains extensive details about the coins, Ethereum Classic blocks, and wallets associated with the attack.

SlowMist added a warning that both ETC and other smaller coins may be vulnerable to 51% attacks, which have gotten easier and cheaper as the value of cryptocurrencies has declined. This drop in value has led many cryptocurrency miners to cease mining, causing the hashrate and the difficulty of the Proof of Work solutions—the mathematical puzzles that must be solved to generate new blocks and their coins—to decline. As ZDNet reports, the offline mining machines likely used in the 51% attack can be rented very cheaply, as ETC uses the same PoW algorithm as ETH.

In a Jan. 9 Forbes article, Nir Kabessa, president of blockchain at Columbia University, said the declines made the attack on Ethereum “not particularly surprising” but added that while leading cryptocurrencies like Bitcoin (BTC) and the main Ethereum (ETH) are vulnerable, such an attack would be “orders of magnitude” more difficult. Other experts quoted in the article disputed the idea that these top-rank cryptocurrencies are vulnerable, citing their much higher hashrate.

Still, this potential vulnerability is one of the factors behind the Ethereum Foundation’s decision to create a hard fork in its ETH blockchain to change from a Proof of Work (PoW) system to a much more energy-efficient Proof of Stake (PoS) consensus model in mid-January. In a PoS model, new blocks are created by a pool of validators depending on random selection influenced by the number of ETH coins staked. Under this Ethereum Constantinople fork, validators will receive a transaction fee rather than coins from the newly generated block, and will be subject to forfeiture of the coins staked for bad actions.