Hacker News Reader

Comment by glofish | Hacker News Reader

It feels surprisingly cheap.

Take bitcoin, a 105Billion cap can be subverted for just 700K per hour?

Not to mention DeepOnion for 3 bucks an hour. I can see people do that just for lulz.

The thing is, what you can do with a 51% attack is very limited and the big services are probably going to be aware of it. Best case scenario is that you halt transactions for a few hours. This will cost a few million dollars with, maybe, no possible reward.

The next problem is that this calculation is based on the current hash-rate cost. However, you don't have that much hardware and it'll be close to impossible to rent half of bitcoin mining rate. So such an attack will be order of magnitudes more expensive if even possible.

You can do much better than that! The simplest way to profit from a 51% attack is to send some coins to a crypto exchange, wait for the required 'n' blocks to confirm your deposit, then 51% attack the chain to remove your original payment. At the same time, you can either withdraw your ill-gotten coins from the exchange, or trade them for something else and withdraw onto a different blockchain entirely.

This mechanism lets you double your money (minus the cost of the 51% attack)

But don't most exchanges have a bigger delay for withdrawing? In order to escape with anything, you would have to withdraw before the exchange was aware of the double-spend, and at that point, they'd freeze your account. The exchange might be on the hook for honoring the phantom coins other users think they bought, but you haven't profited. Am I missing something?

This would require funding, exchanging, and double spending all in the span of a few minutes.

The more confirmations you have to unwind, the more work you have to do to catch up with the long chain.

All that will happen is exchanges require a greater number of confirmations before allowing you to trade deposits.

All true, but it is exactly what happened in this latest attack!

And yes, reportedly exchanges have increased the number of confirmations required to confirm a deposit as a result. But it's too late for the ones who got ripped off by the double spend!

And most exchanges require numerous confirmations for this reason.

From my understanding this is not a 51% attack but rather a chain-rewrite which require significantly way more hash rate than the bitcoin network has. (which is why exchanges consider 3-6 confirmations as the safe number).

For all the big cryptocurrencies, the price assume that you can buy unlimited hashing power if you have the money. That's obviously not true. Once you have rented all available hardware, having more money to spend won't help.

That's what the "NiceHash-able" column is for. To put it simply, if it is less than 100%, you are going to have trouble renting enough hashing power, and conducting the attack will be impossible in practice, or at least much more expensive than the listed price.

Andreas Antonopoulos offers sane advice on this...

https://www.youtube.com/watch?v=ncPyMUfNyVM

51% isn't all powerful. It would mean you could chose what transactions to process and you could potentially (and very visibly) reverse transactions that happen while you have that much hashing power. That's it, you can't transfer money to you.

Merchants who worry about reversing transactions are advised to wait for a few hours before transferring the thing of value, this reduces the ability for someone to deploy a 51% attack and if they did, it would be pretty visible.

The answer of hn_throwaway_99 is interesting

I would add that if an attack on bitcoin is detected, there would be some answer to it, and the actual cost of the attack would really rise

There is also some complexities to get your hand on enough material for doing it during enough time...

The issue with saying how much a 51% attack "costs" is that ALL cryptocurrencies (and, really, ANY currency) is just based on the trust that the currency has "value", meaning that it would be accepted as payment for real goods and services.

A 51% attack on bitcoin would be easily noticeable. If a 51% attack was really "viable", it means that essentially bitcoin would have $0 value, because all of its value is based on the trust that the blockchain is real and verified. The community at large would essentially just ignore the rogue chain, or rather probably boost other existing resources to back it out.

How would the community collectively agree to ignore the rogue chain in a timely fashion? If a client announcement is sent out, that'd help, but there'd still be a lot of people stuck on the original chain (for example, some people on vacation or something). For at least a few days, there'd probably still be a lot of trust to capitalize on, and they could possibly get away with a few big heists (e.g. making a big purchase with BTC and then reversing the transaction after you've received the items).

Also, if the community does ignore the rogue chain, what's to stop the attackers from switching their attack to the other non-rogue chains as soon as they seem to gain traction? If they can hypothetically reliably sustain 51%+ power for weeks, they could potentially perform a DoS on an entire currency. And you're right, Bitcoin would probably soon reach close to $0 (though would probably slowly bounce back once/if the attack seems to be permanently thwarted).

If I'm understanding your last sentence right ("probably boost other existing resources to back it out"), then I also think that'd be the most likely scenario. A serious sustained 51% attack (lasting beyond several days) would turn into a Dragonball Z-like battle, with both sides firing continuous energy beams at each other in parallel. Each side would be trying to increase the magnitude of their beams to keep the other side's beam from collapsing theirs. I think the legitimate mining team would have a lot more energy in reserve (e.g. good samaritans who start mining for the first time to help push away the attackers - kind of like Goku's Spirit Bomb, which Frieza can't replicate) and would probably win. However, if for some reason the attackers can win for weeks at a time, then it'd be a serious DoS.

Disclaimer: I might be misunderstanding something important here. Not a cryptocurrency expert whatsoever.

So: Short a large amount of bitcoins, 51% attack until value plunges, earn massive amounts of money.

Of course, the problem with this is that there is no exchange that you can trust enough to actually do this.

Reply on news.ycombinator.com