What happened
In early June 2018, ZenCash (now Horizen) suffered a 51% attack on its proof-of-work chain. An attacker with enough Equihash hash power mined a private chain, then released it to reorganize the public chain, reverting deposits they had already made to an exchange. Between blocks 318165 and 318275 the attacker caused several reorganizations, the longest reverting 38 blocks, and double-spent three transactions of 3,317.4, 6,600 and 13,234.9 ZEN.
ZenCash said the attacker effectively stole about 23,000 ZEN from one exchange partner, which it described as roughly $600,000 at the time; other reports put it at about $550,000. No new ZEN was created and user private keys were never at risk: the loss fell on the exchange that credited deposits which were later reversed. The team warned exchanges and pools, recommended at least 100 confirmations for ZEN deposits, and noted that Bittrex, which already required 150 confirmations, was not the target.
How it happened
- The attacker gathered enough Equihash hash power to outpace the honest network (ZenCash put total network hash rate at 58 MSol/s at the time, and suggested private mining and/or rented hash power).
- The attacker sent ZEN to an exchange deposit address on the public chain and, once the exchange credited it, traded and withdrew other assets.
- At the same time, the attacker mined a private chain in which the same coins were spent to the attacker's own addresses instead.
- The private chain was released once it was longer than the public one. Under longest-chain consensus it replaced the public blocks, orphaning the exchange deposits (double-spends in blocks 318204 and 318234).
- The exchange was left with withdrawn funds but no deposits, a loss of about 23,000 ZEN.
Protocol details
Evidence
- analysis DeFiLlama defillama.com
- analysis ZenCash Statement on Double Spend Attack (Horizen blog, June 3, 2018, updated June 8; Wayback copy) blog.horizen.io
- analysis ZenCash (now Horizen) Suffers a 51% Attack (DN Institute incident record) dn.institute
- analysis 51% attack on Zencash mining (The Cryptonomist, June 4, 2018) en.cryptonomist.ch
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
