On Wednesday, April 4, the network of the anonymous cryptocurrency Verge fell victim to the so-called "51% attack." As a result, the scammers completely controlled the network and the transactions on it for three hours. We examined how such attacks occur, in which cases they are most likely to take place, and how the attack on the Verge network became possible.

How the "51% Attack" Takes Place

The “51% attack” takes place when the attacking side, sometimes a comparatively small number of miners, has a "controlling stake" of hashes, that is, computing capacity. As a result of the attack, the miners gain control over the entire network and can create blocks at their discretion.

All cryptocurrencies are based on the blockchain networks—distributed ledgers, whose work is supported by the miners. These ledgers store information about all transactions that have ever been conducted in the blockchain hence the name "blockchain" or "chain of blocks." The confirmation of transactions, the generation of new blocks, and the addition of them to the blockchain are handled by the miners who receive remuneration in cryptocurrency for their work.

In a network that uses the PoW (Proof-of-Work) consensus algorithm, in order to add a new block, the miners must perform complex calculations, thereby proving that they have done the work. The first miner who offers the right solution to the problem gets the opportunity to create a new block and an appropriate reward for it. The more processing power at the disposal of the miner, the higher the chances of finding the right solution faster than everyone and the greater the amount of remuneration. When the miner finds the right solution, the system notifies all network participants about it.

It is this key role of computing power that leads to the threat of "51% attack." If the miner or the pool of miners controls more than half of the hash rate, then they have the ability to fully control the network as they can add new blocks, manipulate two-way operations and refuse to confirm new transactions. Also, "51% attack" can lead to the fact that unscrupulous miners can use the same coin several times by recalling transactions made with it, which is called double spending, or double waste. At the same time, the attacking side cannot change information in already added blocks or generate new cryptocurrencies.

It should be noted that blockchain networks using the PoS (Proof-of-Stake) consensus algorithm are much less subject to the threat of "51% attack," since under this algorithm, the validators work on maintaining the operational capacities of the blockchain and their work is based on their share of the network's cryptocurrency (or stake), and not on the computing power of their nodes. Any attack attempt in this system becomes unprofitable.

Most often, new "cryptocurrencies" are jeopardized by the "51% attack," which has not yet managed to garner the support and trust of the crypto community, and accordingly, the miners need less capacity to get a "controlling stake" of the hash of such a network. This attack, however, is unlikely to bring financial benefits to the miners and will more likely be used as a way to eliminate competitors. Another case is an attack on a commercially successful cryptocurrency, but this is an order of magnitude more difficult since the cybercriminals will require huge computing power that is available to only a handful of them.

Known Cases of "51% Attack"

In July 2014, the mining pool Ghash.io briefly gained control of 55% of the capacities of the Bitcoin network. The pool, however, voluntarily agreed to lower its own capacity and not exceed the threshold value of 40% in the future. But even so, at that time the rate of Bitcoin fell by a quarter from its previous value.

In August 2016, the Krypton and Shift cryptocurrency blockchains working on the basis of Ethereum were subjected to "51% attack." Responsibility for the attacks was claimed by members of a group of hackers who refer to themselves as the "51 Crew." As a result of the attacks, the scammers managed to carry out a double waste with the Krypton network's cryptocurrency on the Bittrex exchange and steal about 22,000 coins from both networks.

Attack on Verge

The case with the network of an anonymous cryptocurrency Verge became a kind of precedent because this attack became possible thanks to a bug in the code and not because of the seizure of computing power by some intruders. On April 4, the Bitcointalk forum user ocminer reported that there was a bug in the network code that allowed hackers to add new blocks to the network every second, instead of the prescribed 30 seconds.

This was made possible because the Verge blockchain supports several algorithms, which must be changed with each new block. The attackers sent blocks of the Scrypt algorithm with a false timestamp. The network accepted such blocks, thinking that the last time a block of the Scrypt algorithm had been added was an hour ago. The attack lasted three hours, during which 99% of the blocks of other miners were not accepted.

According to the Verge team, the scammers managed to seize 250,000 XVG tokens as a result of the attack, but the crypto community is sure that the real number is closer to 3.9 million. If this figure is correct, then perhaps the Verge team will have to conduct a hard fork of the network to freeze the lost coins.