Barbarians at the altcoin gates

Yesterday’s 51% attack on Ethereum Classic was the most recent high-profile exploit of a well known problem with smaller coins. The problem is, you can’t just stop the possibility of such an attack—the system is designed to respect whoever has the majority of control—but you can make it harder for a single attacker to take control.

And, though some smaller coins, such as Horizen and Komodo, have already strengthened their defences, it’s time for everyone to learn from and implement their open-source secrets.

But first, to recap: To accomplish the 51% attack on Ethereum Classic, an adversary managed to gain control of enough hashpower—computing power, which typically miners use to create new coins—to rewrite the blockchain. Blockchains work by majority rule, so anyone who can control the majority of the network can influence its record of events. The irony here is that Ethereum Classic existed because it refused to let its blockchain be rewritten after the DAO hack two years ago. Yet between January 5 and 7, it’s blockchain was re-written 15 times, according to Coinbase, losing 219,500 ETC (worth around $1.1 million).

As mentioned, these attacks have become increasingly common. Verge was hit three times last spring in a 51% attack, which resulted in 35 million XVG being created ahead of schedule, mostly by the hackers, and siphoned off. Other attacks include Horizen (formerly known as ZenCash), Vertcoin and Bitcoin Gold; millions of dollars worth of tokens were lost.

Even the recent Bitcoin Cash hard fork points up the inherent problem of what happens when one party can unilaterally direct loads of hashpower to have its way on a network. Though he supposedly had the best interests of the network at heart, Roger Ver was able to pay off miners to do his bidding.

These networks’ vulnerabilities, to good-guy or bad-buy attacks, boil down to one technical issue: If two blockchains use the same algorithm, miners can easily switch from mining one to mining the other one. And this is a problem if someone can muster—by hook or by crook— enormous hashpower on one blockchain, then suddenly move it over to another blockchain.

In fact, this is one way the Ethereum Classic attack might have happened. Considering that it has a hashrate twenty times smaller than Ethereum, anyone with 10% of the Ethereum hashrate could have controlled it. Another possibility: the hashrate could even have been legally rented from a service such as NiceHash. (Estimates of how much it costs to 51% attack a blockchain can be found here—alongside available hashrate.)

The key takeaway is that blockchains that use the same algorithm as a much more popular coin—which is all too common since many blockchains are forked from the most well-known ones—are potentially vulnerable to a hostile takeover. And the rest could be subject to attacks where the hacker simply rents the required hashpower.

OK, so what can be done?

It’s important to note that 51% attacks are a feature—not a bug. Allowing a coin to be fully decentralized means it must be controllable by the masses. However, there are several ways to prevent the nasty side effects of such attacks—such as rewriting past blocks—while keeping the network open.

Some coins have put in measures designed to stop 51% attacks. In June, Horizen suffered from three double spends totalling 23,000 ZEN ($124,000) as the result of one. To do so, the attacker mined a longer chain of blocks in secret—which excluded the three transactions—and broadcast the whole chain at once to the network, replacing the existing chain and making it so the transactions never happened.

The solution? The network was upgraded to penalize miners broadcasting long chains of blocks to the network. This network has been secure ever since that upgrade.

Others have been even more creative. Komodo decided to use the security of the Bitcoin blockchain as a location for backups of its own blockchain. It has 64 “notary” nodes that are voted in by the community. These are responsible for recording a block hash from a Komodo block into the Bitcoin blockchain every ten minutes. This means miners can check which is the correct chain to follow, giving attackers just ten minutes to run a 51% attack. This level of security—known as delayed proof of work—is now being used by five other blockchains.

Several blockchains have decided to upgrade their security after being subject to a 51% attack, including Verge and Horizen. In light of the latest attack, it’s time for some blockchains to be more proactive. Dash, Metaverse and Bitcoin Private, we’re looking at you. Actual money at stake.