Cyber Incident Victim: Ethereum Classic
Date:
Jan 2019
Location:
United States of America
Summary
A 51% attack targeted Ethereum Classic, enabling attackers to double-spend coins by reorganizing the blockchain. Cryptocurrency exchange Gate.io identified approximately $271,500 worth of ETC involved in the incident, while another exchange reported over $1.1 million in affected crypto assets. The attackers later returned $100,000 to Gate.io without explanation, prompting speculation about potential white hat intentions to highlight blockchain security vulnerabilities. The network's low hashrate left it susceptible to similar attacks, leading the exchange to implement heightened deposit confirmation requirements as a protective measure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Ethereum Classic blockchain experienced a 51% attack in early January 2019, with significant activity detected between January 5 and 7. Attackers exploited the network's relatively low hashrate to execute deep chain reorganizations, allowing them to double-spend coins. Cryptocurrency exchange Coinbase publicly disclosed the attack on January 8, reporting that over $1.1 million worth of cryptocurrency had been involved in these chain reorganizations. Gate.io published its analysis on January 9, revealing that 54,200 ETC (valued at approximately $271,500 during the attack period) had been illicitly transferred through double-spending transactions processed on their platform. This malicious activity disrupted transaction finality and undermined confidence in Ethereum Classic's network security.
On January 13, Gate.io reported an unexpected development where the attacker returned $100,000 worth of cryptocurrency to their exchange, though no communication accompanied this partial restitution. The exchange speculated the attacker might have been demonstrating blockchain vulnerabilities rather than pursuing pure financial gain, suggesting a potential "white hat" motivation. In response to the ongoing security risks, Gate.io increased its Ethereum Classic deposit confirmation requirement to 4,000 blocks as a protective measure. The incident highlighted systemic vulnerabilities, with Litecoin founder Charlie Lee noting that susceptibility to 51% attacks represents an inherent characteristic of decentralized proof-of-work cryptocurrencies. Network analysis revealed Ethereum Classic's hashrate remained sufficiently low that attackers could feasibly rent enough computing power to execute similar attacks in the future.