What happened
On May 22, 2018, an attacker took over block production on Verge (XVG), a multi-algorithm proof-of-work coin, and mined about 35 million XVG in a few hours, worth roughly $1.65 to $1.8 million at the time. Nothing was taken from user wallets: the attacker minted the coins as block rewards by forging block timestamps so that mining difficulty collapsed, and legitimate miners' blocks were orphaned.
It was the second such attack that spring. After the April 2018 attack, Verge shipped a hard fork that turned out to be only a partial fix; this time the attacker used a modified version of the same technique across two mining algorithms. Suprnova Pools flagged that someone was 51%-attacking the chain and invalidating legitimate blocks. Verge's team first described the problem as a DDoS on mining pools, then said it was working on a new patch and a new codebase. XVG's price fell about 10% after the news.
How it happened
- Verge lets blocks be mined with several different algorithms and retargets difficulty quickly using timestamps, and it accepted block timestamps within a wide window (reported as up to two hours).
- The attacker mined blocks with falsified timestamps, which misled the difficulty adjustment and pushed difficulty down.
- In the May attack the attacker alternated two algorithms, Scrypt and Lyra2re, both held at a tiny difficulty, and was reported to produce about 25 blocks per minute, or 18,250 XVG (about $950) per minute.
- With most of the block production, the attacker's chain replaced blocks from honest miners, and the attacker collected about 35 million XVG in rewards before the attack stopped.
Protocol details
Evidence
- report Verge (XVG) Hacked Again, 35 Million XVG Tokens Reportedly Generated by Hacker bitcoinist.com
- analysis DeFiLlama defillama.com
- analysis Verge Cryptocurrency Network Falls Victim to Same Attack Even After Hard Fork bleepingcomputer.com
- analysis Verge's Blockchain Attacks Are Worth a Sober Second Look coindesk.com
- analysis vergecurrency.com page vergec….com vergecurrency.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
