Monacoin 51% Attack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Monacoin

The MonaCoin blockchain was used to launch a sophisticated variant of a 51% attack, which was used to double-spend against a number of exchanges, stealing at least $90k in funds. It appears that the blockchain was not rolled back and no funds were returned to the affected platforms.

This exchange or platform is based in Japan, or the incident targeted people primarily in Japan.

About Monacoin

"MonaCoin, or MONA, is a digital currency created in 2013." "MonaCoin is an open source digital currency and a peer-to-peer (p2p) payment network." "It was predominantly used in Japan." "Dubbed by its creators as “the first Japanese cryptocurrency,” the coin has become somewhat of Japan’s national alternative to Bitcoin or Litecoin." "It was launched in 2013 as part of the MonaCoin Project. It is named after "Monā" or "Mona," an Internet meme based on a cat-like figure created using ASCII characters that were popularized on the online community 2channel (or 2chan), which serves as a major information hub for technology enthusiasts. Development of the currency was also announced over 2han."

"Like its predecessors, the coin was created purely to serve as P2P electronic cash, a decentralized digital currency aimed at Japanese citizens. There are a few key differences that set it apart from the coins that came before it, and this guide is dedicated to drawing out these differences. Conceived in December of 2013, Monacoin was officially born on January 1st, 2014 with no premine." "The cryptocurrency was the brainchild of an anonymous “Mr. Watanabe,” who—like Bitcoin’s Satoshi Nakamoto—has never been incontrovertibly identified."

"The algorithm that powers the cryptocurrency is called Lyra2RE(v2), and the currency itself is a fork of Litecoin. New coins are issued as payment for mining activities, which allows the ownership of tokens to be recorded into the MonaCoin blockchain. MonaCoin has an average block creation time of 1.5 minutes, a time that is much faster than Bitcoin's 10-minute block creation time."

"Processing a block of transactions results in an award of MONA, with the amount of coin awarded for mining activities set to halve approximately 1 million blocks (an estimated three years). The total number of coins that will be ultimately made available is 105,120,000, and no coins were “pre-mined” before becoming available to the public. As a result, the initial developers are not expected to make a profit because no mining activities would be conducted in the early stages."

"Between May 13th and 15th, Monacoin, a cryptocurrency developed in Japan, appears to have suffered from a network attack that caused roughly $90,000 in damages." "[T]his is merely another incident that shows that threat actors exist that are both resourced and sophisticated enough to execute this kind of attack." "[M]eanwhile the title says 51% attack, its possible to achieve this attack around 40-45% hashrate as well (however lower the attackers percentage is, lower the chance of succesfully executing the attack)." "The miner, still unknown at this point, had enough computing power to take as much as 57% of the hashrate at one point in order to execute on this attack."

"The reason why this is taking place is due to Monacoin’s mining difficulty re-targeting system. There is a weakness in this system which allows the next network block to be mined very quickly. Additionally, newer blocks can be issued at a rapid pace. While that sounds positive on paper, the reality is very different. No mining entity should effectively control the Monacoin network by any means."

"-one of the mining community witholds the blocks. -due to buggy diff retarget calculation the next block can be mined very easily. -new blocks can be issued rapidly."

"-result 1 = faulty confirmed payments into exchanges (hidden block with a hidden transaction to different address from earlyer and not to exchange + issuing block with payment to exchange and rapidly issued forged blocks relation to this block -> exchange detects proper number of confirmations, then they free up the real block as well, resulting the original forged blocks to be orphanged -> the new chain has no payment to the exchange, but the payment is alreday in the exchange database -> swapping to other coins and withdraw) -result 2 = and stealing the block reward from a lot of blocks"

"The bug is the quite similar as Verge had a month ago. Increasing block age for deposits will not fix it, but increasing the block confirmations actually secures you from the attack aniway. Exchangers and online services should increase it above 100. (There is difference as in Verge the timestamp itself was faked - here a different algorithmic error plays role, which the developers must first find)."

"As of May 19th, Japan time, the attack is no longer occurring, but most exchanges have halted all deposits while they work on fixes to prevent possible future similar attacks. Monacoin balances held in wallets are considered safe." "Western exchages (Livecoin) lost $90k usd due to attack." "[B]ittrex employee contacted me, and told me that they consider delisting the coin if they cant contact twitter.com/tcejorpniocanom - i gave them contacts who might know how to contact the developer, and suggested them to do 300 block confirmations."

"Monacoin dev sent Lae an email, saying that his current advice for exchanges is to increase confirmations to 100 for now, and that he doesn't have a concrete plan moving forward yet." "The bug is the quite similar as Verge had a month ago. Increasing block age for deposits will not fix it, but increasing the block confirmations actually secures you from the attack aniway. Exchangers and online services should increase it above 100. (There is difference as in Verge the timestamp itself was faked - here a different algorithmic error plays role, which the developers must first find)."

This exchange or platform is based in Japan, or the incident targeted people primarily in Japan.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Monacoin 51% Attack

Date	Event	Description
May 15th, 2018	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $90,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

51% attacks can be prevented through a mix of increased block confirmation times and setting checkpoints to prevent large-scale reorganizations. This means the exchange will not credit newly deposited funds, and nodes will be prevented from accepting attacking chains.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.