What happened
On December 1, 2019, Vertcoin suffered its second 51% attack. The attacker mined a private chain and released it, replacing 603 blocks of the main chain with 553 of its own. The reorg enabled five double spends totaling about 125 VTC (about $29).
According to lead maintainer James Lovejoy, the attacker appears to have rented hashpower from NiceHash. He estimated the attack cost 0.5 to 1 BTC, which was more than it could have earned, so it may have been a proof of concept or sabotage rather than a profit-driven theft. The double-spent outputs were coinbase outputs owned by the attacker.
Bittrex, Vertcoin's main exchange, disabled VTC withdrawals once notified, which likely limited losses. Vertcoin had already been 51% attacked in December 2018 and had since switched its proof-of-work algorithm to Lyra2REv3.
How it happened
- The attacker gained majority hashpower on Vertcoin's Lyra2REv3 chain, most likely by renting it from NiceHash.
- It mined a private chain that the public network could not see.
- At 15:19:47 GMT on December 1, 2019, it released the private chain. Nodes switched to it, dropping 603 main-chain blocks for 553 attacker blocks.
- On the new chain, five outputs worth about 125 VTC in total were redirected to attacker addresses. The attacker also swept about 11,000 VTC of rewards to an address it controlled.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
