How the blockchain gets hacked: Attacks on decentralized networks

Core Insights

The article explores various ways blockchain networks can be attacked, highlighting that while blockchains are more secure than centralized databases, they are still vulnerable to threats such as 51% attacks, double-spending, Sybil attacks, selfish mining, smart contract vulnerabilities, and private key theft. Real-world examples illustrate the significant financial losses these attacks can cause, especially for smaller projects. The article concludes that as security measures improve, so do the sophistication of attacks, making ongoing vigilance and innovation essential for blockchain safety.

The blockchain – a distributed ledger that functions as a database – is a much more reliable solution for storing information and conducting transactions than centralized databases. Despite this, it can also be hacked, and attempts are made with worrying frequency. Attacks on decentralized networks vary in nature, but in most cases,, they are aimed at exploiting loopholes in the consensus mechanism and gaining control over the blockchain hash rate. This allows malicious actors to change the data in the registry, create havoc,, and steal cryptocurrency.

In this article, we’ll look at how people attack the blockchain and what the most common threats entail.

The 51% attack

The 51% attack is the main threat to blockchains. It applies to networks that use the proof-of-work (PoW) consensus algorithm.

The Mechanics of the Attack

The basic idea is to take control of more than 50% of the network's computing power, or hash rate. The consequences are similar to owning a controlling stake in a company: you can make any decisions and do whatever you want with the company in which you own the shares. In the case of the hash rate, this means you control 51% of the blockchain's computing power.

If attackers control more than 50% of the mining power, they can reorder transactions, void transaction confirmations, and prevent other miners from mining crypto. In short, they can cause chaos and lead to network failures. They can also cause problems under the radar, such as spending the same cryptocurrency several times (double-spending).
 

How do they get so much power? There are several options, including renting a lot of mining equipment and taking control of – or even setting up – a mining pool. Another option is duping other miners or going down the completely illegal path of running a mining botnet with the help of malware.

Is It Worth the Risk?

Nevertheless, using this method to attack a large blockchain such as Bitcoin, where the network has a very large number of nodes and mining equipment and electricity costs are high, is almost impossible. It’s also generally not worth the effort. Small projects, however, are not immune to this type of threat.

Several networks have suffered 51% attacks, including ZenCash (ZEN), Litecoin Cash (LCC), MonaCoin (MONA), Verge (XVG), and Bitcoin Gold (BTG).

Real-World Examples

After carrying out a 51% attack, attackers can exploit every single protocol vulnerability. In general, however, they are hoping to double-spend.

The successful attack on the ZenCash (ZEN) network in 2018 brought the attackers $550,000. They were able to double-spend two significant transactions worth 13,000 and 6,600 ZEN, respectively. The attack lasted for 110 blocks and 4 hours, though its cost to the network was minimal compared to the stolen coins, at around $30,000.

Another example is Ethereum Classic, which was attacked three times in 2020 by a hacker who had rented computing power from the NiceHash service. Between July and August, the ETC hash rate fell sharply, and the attacker took advantage. They rented GPUs with a hash rate of over 51% of the entire Ethereum Classic network, meaning they could double-spend over 1 million ETC, which was worth more than $9 million at the time.

The cost of renting the hash rate was hundreds of thousands of dollars, so the precise final “profit” is unknown. Unfortunately, there are quite a few similar stories.

Double spending

The double-spending problem emerged long before the blockchain and cryptocurrencies. 

The bottom line is that, when exchanging one item for another, if you don’t complete the transaction in that moment and promise to hold up your end of the deal later, there is always the risk that you won’t have the asset further down the line. 

You could, in theory, provide a document promising payment (a contract, scrip, etc.) to two or three counterparties, despite the fact that the asset being promised only exists in a single copy. This is double-spending. On the blockchain, the principle is exactly the same.

How Double-Spending Works

Double-spending occurs when an attacker spends the same coins twice or more. For example, a user who has 1 BTC sends it to several counterparties at once and receives something in exchange. On the other side of the equation, only one person actually receives this 1 BTC.

When the network is working properly, only one transaction receives approval from the majority of nodes, and this is what usually happens. Security measures are built into blockchains to prevent this type of attack. Nevertheless, there is still a risk of double-spending.

There are different ways to gain the opportunity to double-spend, with the 51% attack being one example. When an attacker controls more than half of the hash rate, they can generate new blocks independently, modify them, and reject certain transactions while confirming the “necessary” ones.

This example shows that attackers created a fork of the main chain and confirmed false transactions while five legitimate transactions were processed.
 

During this time, it would be possible to send coins to a crypto exchange, complete transactions requiring 1–5 blockchain confirmations, and then receive a different cryptocurrency or fiat in return.
 

Later, when the “window of attack” closes, the series of false blocks will be discarded, but for the attacker, the picture looks as follows: they put their tokens on an exchange and sell them, but when the blockchain restores consensus, they still have all of those coins on the original blockchain. What they sold was, in fact, "fake" cryptocurrency.
 

Finney attack

The Finney attack is named after the first recipient of Bitcoin, Hal Finney, who was also the first to suggest the possibility of double-spending cryptocurrencies on the blockchain.

The Finney attack is a variant of the double-spend that can occur when a counterparty accepts an unconfirmed transaction. 

The essence of this attack is that a miner can generate a block and include a transaction from their address "A" to another of their addresses, "B", without immediately broadcasting it to the network. Next, they need to execute another transaction from address "A" to address "C", which belongs to another user. If this user accepts the transaction without network confirmation, the scammer broadcasts the previous block containing the first transaction. The transaction from address "A" to address "C" therefore becomes invalid, and the attacker receives a double benefit.

Race attack

This type of attack is a race between two transactions. A scammer sends the same coins from the same address on different devices to two recipients simultaneously. Both recipients send their goods or cryptocurrencies, but the second-processed transaction is invalidated.
 

This attack is only possible if the merchant accepts an unconfirmed transaction. All that’s required to avoid falling for these “racers'” tricks is to wait for at least one confirmation of the operation.
 

Sybil attack

This attack is named after Sybil, the main character in Flora Rheta Schreiber’s book of the same name, which tells the story of her treatment for dissociative identity disorder. The idea is that hackers populate a network with nodes under their control before “surrounding” a victim’s node, thereby controlling all transactions.

Targeting Vulnerabilities

This is almost impossible to achieve on major networks like Bitcoin, since nodes randomly select other nodes to confirm transactions. 

This is why Sybil attacks usually target new crypto projects. When connecting to the network, a node may not know the IP addresses of trusted nodes and instead requests them. 

If the request reaches the attacker's node, they can respond with the addresses of the nodes they control.

This can allow the hacker to:

• Block the user’s transactions, effectively disconnecting them from the main blockchain;
• Decide which block to “connect” the user to (these are usually blocks where double-spending is taking place);
• Track all of the user’s transactions. 

In short, the attacker-controlled nodes can persuade other nodes to approve incorrect data.

Selfish mining

Blockchains running on PoW have a vulnerability that dishonest miners can exploit: the ability to confirm multiple blocks simultaneously.
 

The Forking Problem

If two blocks are generated at the same time and linked to the previous ones, the blockchain will fork into two chains. Forking makes the blockchain architecture more complex and slows down transactions, which is why miners must immediately broadcast confirmation data to other nodes after confirming a block to prevent conflicts.
 

Despite this, so-called selfish miners hide this information from other network participants and mislead the "honest" nodes, which continue to generate a new chain of blocks and thereby increase the length of the network’s fork.

A Practical Scenario

Let’s say a selfish miner mined block 2,001 but didn’t broadcast it to the network. The remaining nodes continue mining new blocks starting at 2,000. This means there are now two blocks claiming to be the 2,000th: one from an honest miner and another from an attacker. Both of these blocks are associated with their own block 2,001.
 

The fraudsters continue to generate blocks and add them to their chain, which lengthens accordingly. The hackers then transmit data about block 2,001 that they have mined; the network recognizes that it was found first, classifies the selfish chain as valid, and discards the blocks that were added by honest nodes during the same period. As a result, honest miners don’t receive rewards, and their efforts go to waste.
 

Routing attacks

These attacks are not directly related to security issues on the blockchain itself. Instead, they exploit vulnerabilities in the connection protocols of internet service providers (ISPs). 

By gaining access to the protocol, a hacker can publish false routes. Notably, this type of attack can be used to double-spend. If you delay the delivery of new blocks, they will not be visible to the network, creating a window during which the crypto can be double-spent.
 

Exploiting smart contract vulnerabilities

Smart contracts are coded by humans, and humans make mistakes.

The Cost of Code Errors

Various vulnerabilities can be found in smart contracts. It could be a complex problem that is very difficult to detect, or perhaps a typo in the code. One way or another, any mistake leaves open the possibility of losing millions of dollars.

In a report dated 30 June 2023, the Web3 security company Beosin reported that the total value of cryptocurrency lost through fraud, hacks, and scams in the first half of 2023 was $656 million. Most (56%) of the stolen cryptocurrency was lost due to smart contract vulnerabilities.

It isn’t just vulnerabilities in the smart contracts themselves that can lead to blockchain hacks, but also the language in which they are written. On 30 July 2023, four Curve Finance liquidity pools were compromised due to

 a vulnerability in Vyper, the programming language used to write smart contracts for the Curve exchange. Curve Finance is a decentralized exchange with automated market-making (AMM) technology and the main stablecoin liquidity hub in DeFi. In total, about $60 million was stolen, of which $20 million was recovered by white hats and returned to Curve. Most of the damage resulted from a hack of the main CRV/ETH pool, which drained it of all its liquidity (about $40 million).

DDoS and time-dilation attacks

DDoS attacks are not carried out in order to steal crypto, but to damage crypto projects and discredit startups. They involve sending a huge number of useless, “dust” transactions to the network, which complicates its operations, slowing down the transfer of data, blockchain updates, and the creation of new blocks in the chain.

Attacks on private keys

To ensure the confidentiality of data transmission in public channels on the blockchain, asymmetric encryption technology is used, namely cryptography with private and public keys. These private and public keys are linked by a mathematical algorithm. If you know a user's public key, you can encrypt a message for them, which they can read by decrypting it with the private key. If you have the private key, you can use it to figure out the public key – the reverse, however, is not true.

Private keys provide full access to all of a user’s crypto assets, which is why attackers want to access them.

Vulnerabilities and Protection

The easiest way to gain access to a private key and its associated cryptocurrency is through a seed phrase, which can be acquired by simply stealing a piece of paper containing a mnemonic code, or through other methods such as social engineering and phishing attacks.

To securely protect your private key and, accordingly, all of your crypto assets, you can entrust its storage to Tangem Wallet. The Tangem crypto wallet doesn’t use a seed phrase, which means it cannot be stolen. The private key is generated and stored on the chips of two or three cards (the main card and backup cards), where it remains and from which it is impossible to extract.

Conclusion

It’s important to be aware that the blockchain is currently facing many threats, including all of the high-profile attacks listed above, as well as problems with specific networks, such as errors in the programming code, encryption methods, and more. Hackers are continually looking for these loopholes and trying to take advantage of them by identifying vulnerabilities in smart contract code, exploiting weaknesses in blockchain technology itself, and attacking cryptocurrency exchanges.

Hypothetical Threats

There are other forms of attack which are, for now, purely hypothetical:

• Cannibalism among pools (the destruction of a pool to disrupt the operation of the blockchain);
• The P + epsilon attack: according to Vitalik Buterin, this is one of the most unsettling issues on PoW networks, and it involves giving a bribe of sorts to other network participants in exchange for their support for proposed changes to the blockchain;
• Timejacking (attempts to manipulate the timestamps of transactions).

For now, it appears that hackers are not interested in these attack strategies.

Looking Ahead

There is only one solution to everything we’ve discussed – continually improving the security mechanisms of decentralized networks. Experience shows, however, that the higher the level of protection, the more sophisticated the methods miners and hackers develop to bypass it. This is a battle that will probably go on forever. In the world of traditional finance, ATMs are hacked, credit cards are stolen, and banks are robbed. There is no such thing as a 100% security guarantee.