ETC 51% attack investigation: Independent miners spent only 17.5 BTC to reorganize 3594 blocks

On August 3, ETC’s official Twitter account released an investigation report by blockchain data analysis company Bitquery on the 51% attack on ETC. The report showed that ETC suffered a 51% attack from 0:30 on August 1 to 11:30 on August 2.

The attack was initiated by an independent miner "0x75d1e5477f1fdaad6e0e3d433ab69b08c482f14e". The miner quietly produced 3594 blocks and then broadcast them to other miners. Due to the large number of blocks, the block order has a greater weight than the chain established by other miners, causing other miners to accept this series of blocks. In the end, the attacker's block successfully replaced the original block, and the reorganization occurred from block height 10904146 to 10907740. The on-chain data shows that the miner deliberately purchased hash power from outside to launch the attack, and the miner's address has only been shown as active since July 29, generating 30 blocks every day for 3 consecutive days. In the end, the attacker only spent 17.5 BTC (about 170,000 US dollars) to deceive the entire ETC network for 12 hours and successfully carried out the attack.

In addition, since not all software run by nodes and miners in the ETC network has the same behavior, the diversity of node versions and software makes this attack more serious: 1. Nodes based on the two clients of Geth and Hyperledger Besu accept the attacker's blocks and choose the longest forked chain; 2. Nodes based on the Open Ethereum client still retain the old chain. All of these have led to some miners transferring money based on the old chain, but it is not reflected on the main ETC chain (forked chain), and nodes based on different clients may face double spending.