The 2019 and 2020 51% Attacks on Ethereum Classic

Definition

In the realm of blockchain technology, a 51% attack represents a critical vulnerability, particularly for Proof-of-Work (PoW) networks. It occurs when a single entity or a coordinated group gains control of more than 50% of a blockchain network's total mining power, also known as its hash rate. This majority control allows the attacker to manipulate the order of transactions and prevent legitimate transactions from being confirmed, fundamentally undermining the network's integrity and the immutability of its ledger.

A 51% attack is a scenario where an attacker or group controls over half of a blockchain's mining power, enabling them to reorganize transaction history and execute double-spends.

Key Takeaway

The 51% attacks on Ethereum Classic (ETC) in 2019 and 2020 served as stark reminders of the inherent security risks faced by Proof-of-Work blockchains with insufficient hash rate security. These incidents demonstrated that even established cryptocurrencies can be susceptible to significant manipulation, leading to considerable financial losses for exchanges and eroding investor confidence. The primary mechanism of these attacks was the double-spend, where an attacker effectively spent the same digital coins twice by reversing previously confirmed transactions.

Mechanics

The mechanics of a 51% attack in a Proof-of-Work system are intricate, relying on the network's fundamental consensus rule: the longest (or heaviest) valid chain is considered the canonical one. An attacker first accumulates or rents sufficient hash power to exceed 50% of the network's total, often through mining pools or cloud mining services. With this computational dominance, they begin secretly mining a private version of the blockchain, starting from a block before a transaction they wish to reverse. On this private chain, the attacker deliberately omits the transaction they want to reverse, or includes a conflicting transaction, effectively creating an alternative history.

Simultaneously, the attacker executes a legitimate transaction on the public, honest chain, typically sending a significant amount of funds to a cryptocurrency exchange. Once this transaction receives a sufficient number of confirmations on the public chain, making it appear final, they quickly withdraw the corresponding assets from the exchange. Immediately after this withdrawal, the attacker releases their privately mined chain. Due to their majority hash power, this private chain has been growing faster and is now longer than the public chain. The network's nodes then recognize this longer chain as the legitimate one, triggering a chain reorganization. The original transaction to the exchange is effectively erased from the new canonical history, allowing the attacker to retain the original funds while also possessing the assets withdrawn from the exchange – a classic double-spend scenario. This process exploits the probabilistic finality inherent in PoW blockchains, where transactions are considered truly final only after a substantial number of subsequent blocks have been mined on top of them, making earlier transactions increasingly difficult to reverse.

Trading Relevance

For traders and investors, 51% attacks introduce significant market volatility and risk. When a network is compromised, the immediate reaction is often a sharp decline in the asset's price as confidence erodes and fear of further attacks spreads. Cryptocurrency exchanges, as primary targets for double-spend attacks, may halt deposits and withdrawals for the affected asset, as Coinbase did during the 2019 ETC attack. This severely impacts liquidity, preventing traders from managing their positions, exiting trades, or capitalizing on market movements. Such halts can lead to forced liquidations for leveraged positions or an inability to exit trades, resulting in substantial and often unavoidable losses for market participants.

Beyond immediate price impacts and liquidity issues, successful 51% attacks can have long-term consequences for a cryptocurrency's perceived security and viability. The repeated nature of the ETC attacks, for instance, raised serious questions about its fundamental security model and its ability to attract and retain users, developers, and institutional interest. For those engaged in active trading, understanding the hash rate distribution, the economic cost of mounting a 51% attack on a particular chain, and the project's response to past vulnerabilities becomes a critical part of risk assessment. Assets with lower hash rates, or those that are forks of larger chains (and thus share similar mining algorithms, making hash power rental easier), are often considered more susceptible, making them inherently higher-risk trading instruments that demand careful due diligence.

Risks

The primary risk associated with a 51% attack is the potential for double-spending, which directly leads to significant financial losses for cryptocurrency exchanges, merchants, and individual users who accept transactions that are later reversed. For exchanges, this means losing the assets they paid out based on a transaction that was subsequently invalidated from the blockchain's history. These losses can amount to millions of dollars, as vividly demonstrated by the Ethereum Classic incidents. Beyond direct financial loss, the integrity and immutability of the entire blockchain network are severely compromised, leading to a profound loss of trust among its participants, which is detrimental to any decentralized system.

Furthermore, a successful 51% attack can have cascading negative effects, deterring new investment, reducing network adoption, and negatively impacting the development ecosystem. The perceived insecurity can make it exceedingly difficult for the project to recover its reputation and market value, potentially leading to a death spiral. For smaller Proof-of-Work chains, the economic cost of renting sufficient hash power for an attack might be relatively low compared to the potential gains, making them attractive targets for malicious actors. This creates an existential threat, as repeated attacks can render a blockchain effectively unusable and worthless, highlighting the critical importance of a robust, decentralized, and economically secure mining community to safeguard the network against such sophisticated threats.

History and Examples

Ethereum Classic, a hard fork of Ethereum that retained the original blockchain history after the infamous DAO hack, has unfortunately been a target of multiple 51% attacks, serving as a prominent case study for this vulnerability. The first significant incident occurred in January 2019. Cryptocurrency exchange Coinbase detected a "deep chain reorganization" of the Ethereum Classic blockchain on January 5th, which was indicative of a 51% attack. This attack resulted in a double-spend worth approximately $1.1 million. Coinbase reacted swiftly by halting all ETC transactions on its platforms, products, and services to protect customer funds and prevent further losses. The attacker had managed to control the majority of the network's mining power, enabling them to manipulate the transaction history and execute the double-spend.

A second, even more severe attack occurred between July 31 and August 1, 2020. In this incident, an attacker successfully double-spent 807,260 ETC, valued at approximately $5.6 million at the time. Reports indicated that the attacker spent around 17.5 BTC (equivalent to about $192,000) to acquire the necessary hash power for this operation, demonstrating the economic viability of such attacks on networks with lower hash rates. In addition to the double-spend gains, the attacker also received approximately 13,000 ETC as block mining rewards. These repeated attacks underscored the urgent need for Ethereum Classic to strengthen its network security. In response, the ETC community implemented various upgrades and introduced measures, such as the Modified Exponential Subjective Scoring (MESS) protocol, to increase the network's resilience and make future 51% attacks significantly more difficult and costly, aiming to restore confidence in the chain's security.

Common Misunderstandings

One prevalent misunderstanding regarding 51% attacks is the belief that they enable attackers to steal arbitrary funds directly from other users' wallets. This is incorrect. A 51% attack does not allow an attacker to compromise private keys or directly drain funds from third-party wallets. Instead, its primary capability is double-spending, which involves reversing transactions that the attacker themselves previously made. The attacker must possess the coins they intend to double-spend; they cannot simply create new coins or steal existing ones from unrelated addresses. The manipulation is focused on the transaction history and the confirmation of the attacker's own transactions, not on gaining unauthorized access to other users' assets.

Another common misconception is that all Proof-of-Work blockchains are equally vulnerable to 51% attacks. The susceptibility of a network is highly dependent on its total hash rate and the economic cost required to acquire or rent more than 50% of that power. Networks with extremely high hash rates, such as Bitcoin or Ethereum (prior to its transition to Proof-of-Stake), are incredibly difficult and prohibitively expensive to attack due to the immense computational resources required. Smaller networks with lower hash rates, however, are considerably more vulnerable. While Ethereum Classic faced multiple attacks in the past, the project has since implemented significant security enhancements, including protocol changes designed to increase the cost and difficulty of such attacks, leading to claims that the network is now "stärker als je zuvor" (stronger than ever) against these threats.

Summary

The 51% attacks on Ethereum Classic in 2019 and 2020 are prominent examples of the potential vulnerabilities of Proof-of-Work blockchains, especially when hash rate security is not sufficiently robust. These attacks, which led to significant double-spend losses for cryptocurrency exchanges, highlighted an attacker's ability to manipulate transaction history by controlling the majority of mining power. They underscored the necessity for continuous evaluation and strengthening of network security to ensure the integrity and trust in decentralized systems. For market participants, these historical events serve as an important lesson in risk assessment and the significance of a cryptocurrency's underlying consensus mechanisms.