What happened
Vertcoin (VTC), a proof-of-work cryptocurrency that used the ASIC-resistant Lyra2REv2 algorithm, was hit by repeated 51% attacks between October 12 and December 2, 2018. An attacker with majority hashpower rewrote recent chain history 22 times, and 15 of those reorganizations double-spent VTC. Coinbase security engineer Mark Nesbitt estimated the double spends were worth over $100,000. The deepest reorg, in the final wave (November 29 to December 2), replaced 307 blocks with a 310-block attacker chain.
The attacks came in four waves: October 12-18 (8 reorgs, 71,243 VTC double-spent in the last 3), October 27-28 (8 reorgs, 53,847 VTC), November 3 (2 reorgs, no double spends), and November 29 to December 2 (4 reorgs, all with double spends). The final wave's reorgs were much deeper, which suggests the victim had raised its confirmation requirement and the attacker simply spent more hashpower to overcome it. CoinDesk reported that attacking Vertcoin for an hour cost about $131 in rented hashpower from NiceHash at the time. The attacks came as VTC's price had collapsed, which made hashpower cheap to rent.
How it happened
- The attacker obtained more hashpower than the rest of the Vertcoin network combined. Because Lyra2REv2 ran on general-purpose GPUs, that capacity could be rented instead of bought.
- The attacker sent VTC to a victim, typically an exchange deposit, in a transaction that was mined into the public chain. At the same time it privately mined a competing chain in which the same coins went to another address it controlled.
- After the victim credited the deposit and the attacker had traded or withdrawn the value, the attacker released its longer private chain. Nodes switched to it, orphaning the block with the original payment.
- The victim's deposit disappeared from history while the attacker kept the coins. Raising confirmation counts did not stop it: the final reorg was 307 blocks deep.
Protocol details
Evidence
- report Vertcoin (VTC) was successfully 51% attacked (Mark Nesbitt, Coinmonks, Dec 2, 2018; Wayback copy) medium.com
- report Vertcoin loses over $100,000 in 51% attack: report coingeek.com
- analysis DeFiLlama defillama.com
- analysis Vertcoin's Struggle Is Real: Why the Latest Crypto 51% Attack Matters coindesk.com
- analysis vertcoin.org page vertcoin.org vertcoin.org
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
