BTG users lose millions in a 51% attack

Summary #

Bitcoin Gold was hit by a 51% attack on May 19, 2018. The attackers were able to double-spend 388,000 BTG, worth around $18 million at the time of the attack. Affected exchanges included Bitinka, Bithumb, Coinnest, Bittrex, and Bitfinex, while wallets such as the official Bitcoin Gold wallet and Ledger wallet were also impacted. As a result of the attack, Bitcoin Gold’s value dropped from around $60 to $30 per coin. Most likely, the attack was carried out by renting hash power from NiceHash, a hashing power marketplace. Following the attack, the Bitcoin Gold team implemented upgrades, such as Equihash-BTG and a “checkpoint,” to enhance security. Exchanges increased the number of confirmations required for BTG transactions to prevent similar attacks in the future.

Attackers #

Some sources have speculated about the possibility of attackers using NiceHash to rent the necessary hash power to carry out the 51% attack, a hashing power marketplace. This means that the attackers did not need to own any specialized mining hardware in order to carry out the attack.

Losses #

The attackers managed to steal approximately $18 million worth of BTG. This was achieved through double-spending transactions, which allowed the malicious actors to spend the same coins multiple times by manipulating the blockchain. The losses incurred during the attack were mostly borne by the affected cryptocurrency exchanges that had accepted the fraudulent deposits. As a result, many exchanges increased the number of confirmations required for BTG transactions to be considered valid, making it more difficult for similar attacks to occur in the future.

• Total amount of Bitcoin Gold stolen: 388,000 BTG, worth around $18 million at the time of the attack.
• Exchanges affected by the attack: Bitinka, Bithumb, Coinnest, Bittrex, and Bitfinex.
• Wallets affected by the attack: Official Bitcoin Gold wallet, Ledger wallet.
• Impact on the value of Bitcoin Gold: The value of Bitcoin Gold dropped significantly from around $60 to $30 per coin due to the attack.

Timeline #

• May 15, 2018: The hash rate on the Bitcoin Gold network increased dramatically from 1.5 Gigahashes/sec to 5 Gigahashes/sec, indicating an attempted takeover of the network. Most likely, the attackers rented hash power from NiceHash, a hashing power marketplace, to execute the attack.
• May 16, 2018: The Bitcoin Gold team announced the implementation of Equihash-BTG, a new proof-of-work algorithm designed to enhance security and prevent centralization. Equihash-BTG was ASIC-resistant, which prevented specialized mining hardware from dominating the network. The algorithm also required more memory, making it more challenging for attackers to rent hash power.
• May 18, 2018: The Bitcoin Gold network upgrade was completed through a hard fork of the blockchain. The upgrade aimed to enhance security and prevent centralization by making it more difficult for attackers to gain control of the network.
• May 19, 2018: The first 51% attack on the Bitcoin Gold network occurred, lasting several days, during which attackers double-spent over 388,000 Bitcoin Gold coins, worth around $18 million at the time of the attack. The attackers were able to manipulate the blockchain, reverse transactions, and steal funds. Other exchanges affected by the attack include Bitinka, Bithumb, and Coinnest, and various wallets were also affected, including the official Bitcoin Gold wallet and the Ledger wallet.
• May 21, 2018: Multiple exchanges, including Bittrex and Bitfinex, suspended Bitcoin Gold trading to prevent further damage to their platforms and users. The value of Bitcoin Gold dropped significantly from around $60 to $30 per coin due to the attack.
• May 22, 2018: The Bitcoin Gold team issued a statement acknowledging the attack and working with exchanges and wallet providers to investigate and mitigate the damage. The team was in communication with exchanges and wallet providers to determine the extent of the losses incurred during the attack.
• May 24, 2018: The Bitcoin Gold team implemented a new upgrade, known as a “checkpoint,” to prevent further blockchain manipulation by the attackers. The checkpoint identified the last “clean” block and ensured that all subsequent blocks were added on top of it, preventing any changes to the blockchain’s history. However, some members of the community criticized this move, arguing that it went against the principles of decentralization.

Security Failure Causes #

• Lack of diversity in mining hash power: The Bitcoin Gold network was dominated by a small number of miners, which made it easier for attackers to gain control of the network. Some mining pools had accumulated a significant percentage of the total Bitcoin Gold network hash rate, leading to the centralization of mining power. This centralization made it easier for attackers to rent or buy enough hash power from mining marketplaces like NiceHash to gain control of the network.
• Weaknesses in the proof-of-work algorithm: The Equihash algorithm used by Bitcoin Gold was not as secure as some other algorithms, making it easier for attackers to mine blocks. Equihash was designed to be more ASIC-resistant and promote decentralization. However, ASIC miners were eventually developed for Equihash, allowing some miners to amass significant amounts of hash power. This centralization of mining power made it easier for attackers to launch a 51% attack.
• Lack of security measures: The Bitcoin Gold team did not implement sufficient security measures to protect the network from attack.
• Lack of robust security measures: The Bitcoin Gold network participants did not have sufficient safeguards in place to protect against 51% attacks, such as requiring a higher number of confirmations for transactions to be considered valid. In the wake of the attack, many exchanges increased the number of confirmations required for BTG transactions, making it more difficult for similar attacks to occur in the future.
• Lower network security awareness: Smaller and newer cryptocurrencies like Bitcoin Gold often have less community awareness and developer support, which can result in security vulnerabilities being overlooked or not addressed promptly.