Blockchain Attacks
Thanks to its blockchain architecture, the Bitcoin network enjoys many inherent safeguards against traditional security threats. Nonetheless, it is not immune to exploitation.
In this article, we review some of the most popular attacks in the world of blockchain technologies, including how they are technically carried out and who is at risk.
Solving the Double-Spending Problem
Perhaps the biggest issue facing digital currency is its lack of proof that users haven’t spent the same money twice. Traditional financial systems solve this problem by adding the superstructure of banks and other financial institutions, which account for each payment and ensure that funds are not double-counted.
Bitcoin was the first digital currency to offer an alternative solution that did not require a third-party intermediary. It did so by employing a decentralized network of nodes that follow the same protocol to reach consensus about, and to store, transactional data. Once a transaction receives confirmation and is added to the blockchain, it becomes irreversible.
Thus, in order to double-spend bitcoins or any other cryptocurrencies, a user must either gain control over a significant portion of the network or find a way to feign that a transaction has been confirmed. Here are some of the best-known methods for this kind of subterfuge.
51% Attack (Reorganization)
The 51% attack implies that bad actors gain control of over 51% of all the nodes in a network, allowing them to control the network by taking advantage of its majority-based consensus protocol. Such control would all the bad actors to double-spend cryptocurrency and reverse transactions. Possessing the majority of the network’s mining power would allow such bad actors to launch a new branch of the blockchain.
Who’s at Risk?
Such schemes only apply to cryptocurrencies that are based on the proof-of-work consensus algorithm, such as Bitcoin and its derivatives. The more concentrated the majority of a network, the greater the risk. The website AreWeDecentralizedYet shares some further considerations.
The most popular cryptocurrencies are still controlled by just a few entities - AreWeDecentralizedYet
Because of its widespread, large network, the risks of such an attack with respect to Bitcoin appear relatively low.
However, smaller projects with fewer nodes face higher risks. Some notable attacks have taken place in past years:
- Ethereum Classic. Advocates of the classic approach have been attacked many times throughout this project’s existence, which is supported solely by its community. A few minor attacks took place in 2019, and in 2020, hackers have managed to steal $5.6 million worth of ETC—Ethereum’s currency.
- Bitcoin Gold. $18 million worth of Bitcoin Gold’s BTG currency was stolen during a 51% attack on this altcoin network in May 2018. A smaller attack resulted in a loss of only $70,000 in January 2020.
A similar type of attack requires that hackers take control of only 34% of a network, and it threatens networks based on the Tangle blockchain, such as IOTA. The IOTA project is aware of such a threat, and the team behind it has been working to improve the platform’s security. The “coordinators” who prevent blockchain hacks have developed one of the solutions that have been implemented so far.
Race Attack
When attempting a race attack, hackers quickly send the same coins to a vendor and to their own wallet—one right after the other. If an attacker controls a node, they may reject the first transaction, prioritize the second transaction, and broadcast this second transaction to the rest of the network, thus deceiving other users.
Merchants who send out goods purchased through these hacks without waiting for transaction confirmations are at risk. To reduce the chance of such attacks, users should connect only with trusted nodes, disable incoming connections, or change their order fulfillment policies and send out goods only after a transaction is confirmed by at least one node.
Finney Attack
The Finney attack also targets merchants who do not wait for transaction confirmations before releasing goods. This type of hack bears the name of a famous Bitcoin adopter, Hal Finney, who suggested this attack for the first time in his post on Bitcointalk in 2011.
For this hack, attackers have to run their own node. They include transactions between their own wallets into new blocks that they generate themselves. These coins are double-spent, and the deceived seller sends the ordered goods. Then the new blocks are released into the network. Transactions with respect to these blocks are given higher priority and, thus, only they are registered on-chain.
Vector 76 Attack
A Vector76 attack technically combines the race and Finney attacks into one hack. Essentially, attackers create two transactions simultaneously and broadcast them to different parts of a network. One of the transactions bears a high value and is sent to the attackers’ address, while the other transaction is small. Attackers are credited with the high amount while the second transaction eliminates the first transaction and obtains the network’s final acceptance.
This type of attack is not common because it requires a node with an incoming transaction and a hosted wallet that accepts payments after only one confirmation. These characteristics are difficult to achieve.
Sybil Attack
The Sybil attack was invented long before blockchain technologies. It threatens any online system where a single unit can attempt to control a network by creating multiple identities. On the blockchain, an attacker can run multiple nodes and outvote legitimate network participants. In fact, a Sybil attack is a minor instance of the 51% attack described above.
To prevent Sybil attacks, blockchains implement different consensus algorithms — such as proof-of-work and proof-of-stake — which increase the cost of such attacks and make them unprofitable for potential attackers.
