Statement Regarding Bittrex

September 1, 2018 | Announcement

We regret to inform our community that the crypto exchange Bittrex has decided to de-list BTG after we declined to pay them 12,372 BTG to remain listed.

We suspect the impact Bittrex’s action on our Ecosystem will not be substantial, as Bittrex has not been a top liquidity provider for BTG in recent months (current top exchanges include HitBTC, Bithumb, Binance, Bitinka, and Bitfinex; Bittrex markets represent a small fraction of our volume at this time.)

Bittrex announced this decision today based on a double-spend attack they suffered back on May 19th, despite all our efforts to assist them, and despite the fact that the danger is now over. As a reminder, in May malicious parties used rented power from NiceHash to perform 51% attacks which they used to attack exchanges with double-spends. After our successful Network Upgrade hardfork on July 3rd, the risk is mitigated, and most exchanges have re-opened their wallets and reduced confirmation requirements to pre-Upgrade levels.

Bittrex informed us that they make this decision because the BTG team would not “take responsibility for our chain,” and that taking responsibility meant paying Bittrex 12,372 BTG to cover the loss they incurred. They later informed us they would cover part of the loss from their own BTG reserves and requested we pay the remaining ~6000 BTG, and that if we did not, we would be delisted. This may seem like a small amount to a profitable exchange, but it is a significant fraction of the available funds from the Endowment which supports the Bitcoin Gold project. (Our non-profit organization has no revenue streams, all BTG mining rewards go to miners, and nearly half the funds in the Endowment remain time-locked for future use – recall that 60,000 of the 100,000 coins mined to establish the Endowment were time-locked for up to 3 years from November of 2017.) We offered a BTG loan from the Endowment to help Bittrex address short-term liquidity problems, but they declined and insisted on a payment.

In light of the potential impact on the BTG Community, our Board carefully considered their demand but concluded we are not empowered to make a disbursement from the Endowment for the purpose of covering a private company’s losses from their own security failures. The Endowment is intended for direct long-term expenses of running the project, as covered in our founding Roadmap/Whitepaper.

Everyone knows 51% attacks and Double-Spends have always been a known risk in the PoW blockchain world. The attacks on exchanges in May were not the result of any fault or flaw in the BTG blockchain or code (which are essentially the same as the Bitcoin code.) The attackers rented massive hashpower through the NiceHash rental market (perhaps aided by their own mining pools and/or ASICs) – the attackers bear responsibility for their attacks.

The Bitcoin Gold team is not responsible for security policy within private entities like Bitrex; those who earn revenue running a private business must manage the related risks and are ultimately responsible for their own security.

All that having been said, during the 3.5 days in question, the Bitcoin Gold Team took extensive measures to help Bittrex – and other exchanges – defend themselves. We:

  • gave Bittrex the attacker’s wallet address
  • advised they raise their confirmation requirements to give them adequate time to respond
  • advised them to flag and review any unusually large deposits
  • we even warned them of the onset of the actual attack which victimized them

Despite all of our efforts, Bittrex was the victim of the last and largest BTG double-spend the attackers performed. The attackers deposited 12,371 BTG from the wallet we previously identified. Several hours later, Bittrex allowed them to trade that BTG and withdraw some amount of other coins, and then the attackers used the 51% attack to double-spend those BTG, invalidating their original deposit. (We do not know the net value of Bittrex’s loss since they have not disclosed the value of the coins they allowed to be withdrawn.)

We feel it’s clear that we took every reasonable step to try to help ensure Bittrex’s safety against this threat.

All our exchange partners can rest assured we will continue to work to assist them whenever possible, and that we will continue to work towards improvements which will increase safety in the crypto space.

Respectfully yours,
The Bitcoin Gold Organization


Appendix A:

Actions the BTG team took during the attack, in chronological order.

During the 3.5 days in May where all the 51% attacks took place, the BTG organization took the following steps:

  1. Informed all major Exchanges (including Bittrex) of the ongoing attacks via their support processes, with messages marked “CRITICAL RISK.” These messages also implored all exchanges to join our Emergency Notification Telegram channels to share real-time information. Bittrex did not send any staff to join the channel at that time.
  2. Senior people from our team shared the fact that the attacks were ongoing directly with Bittrex senior staff through the Bittrex Slack (Bittrex was aware when the attacks began, being among the first to notice and report the initial attack’s block reversion.)
  3. We shared the exact wallet address from which the Double-Spend attacks were being made, as well as the mining addresses being used for the 51% attacks. This was shared with the Emergency Telegram, was shared with Bittrex directly, and was publicly posted on our Forum (which was additionally promoted via Twitter, Reddit, and other Social Media channels.)
  4. We specifically advised that all Exchanges raise their confirmation requirements to give them ample time to react and that they monitor unusually large deposits of BTG – the double-spend attacks were clear outliers in size.
  5. We put in place automated monitoring of the NiceHash Equihash market, responding to it 24 hours a day, and alerted the Emergency Telegram participants whenever there was a sign of an impending attack.
  6. Just before midnight (UTC) on May 18th, we observed activity on NiceHash clearly indicating another large attack had begun. We directly informed Bittrex of this and informed the Emergency Slack. Nearly six hours later, Bittrex became the victim of the last, and largest, Double-Spend attack.

After the attacks ended, we continued to monitor and report suspicious NiceHash activity for the following weeks until our Network Upgrade – as we stressed all along, the NiceHash attacks we observed could be attacks on other Equihash-mined coins, so we alerted the exchange whenever we witnessed unusual activity, even when we did not believe that the BTG chain was being used.

As always, the BTG Organization will continue to try to act in the best interests of the broader crypto community.


Appendix B:

BTG blockchain-based public records of the attack on Bittrex

12,239 BTG was deposited to a Bittrex account from the known attack address in this transaction: ee798dd31beda909c9ca7f843bc58b48dfb40b0f6db83ccd10e892e9c3154ce7
(Originally marked as Confirmed, now marked as Unconfirmed)

That deposit was made as part of this block #529022.
(Originally marked as mainchain, now marked as Orphaned. It was mined by honest miners.)

The deposit was confirmed over the course of nearly six hours on mainchain with 21 additional blocks mined, up to and including this block #529043.
(Originally marked as mainchain, now marked as Orphaned. It was mined by honest miners.)

Some time after the 20th block, which satisfied the 20-confirmation requirement for Bittrex, the attacker was able to trade their BTG on Bittrex and withdraw other crypto.

The attacker then released 23 (or more) secretly mined blocks to the mainchain, superseding the existing 22 blocks, and replacing their previous transfer of 12,239 BTG to Bittrex with a transfer of those same 12,239 BTG to themselves.

Here is the new transaction (double-spend) of the original 12239 BTG, sent to their own address instead of Bittrex: 8b8ad1deb88c9b9e36c62e96ff52833d4ca1632076b1092a5848de788181aaaf
It was included in this block #529022, which was first mined by the attackers in secret and not broadcast to the network until nearly 6 hours later. When it was finally broadcast along with 22 or more other secretly-mined blocks, for a total of over 23 blocks, it established the “longest chain” and took over as mainchain, causing the previously seen blocks to become “Orphaned.”


Want to comment? Join the discussion at forum.bitcoingold.org