Coinbase documented 15 Ethereum Classic reorganizations and $1.1 million in double-spends

Coinbase reported on January 7, 2019 that it had detected repeated deep reorganizations of the Ethereum Classic blockchain, including transactions in which the same ETC was spent twice. By its 10:27 p.m. Pacific update, the exchange had identified 15 reorganizations, 12 containing double-spends totaling 219,500 ETC, which Coinbase valued at approximately $1.1 million.

The disclosure turned a known theoretical weakness in proof-of-work consensus into an immediate settlement problem for exchanges and other businesses accepting Ethereum Classic deposits. Coinbase said it had stopped sending and receiving ETC while leaving customer buying and selling available. It also said no Coinbase accounts were affected and that Coinbase itself was not the recipient targeted by the observed double-spends.

What Coinbase observed

Coinbase’s systems first alerted engineers to an unusually deep reorganization late on January 5. The exchange disabled blockchain interactions early on January 6 and publicly described “unstable network conditions” through its status service. Following technical and legal review, Coinbase published its analysis on the morning of January 7 and expanded it as additional reorganizations appeared.

A chain reorganization occurs when nodes replace blocks they had previously accepted with a competing history carrying more accumulated proof of work. A reorganization is not necessarily malicious: short replacements can occur during normal mining. The risk becomes acute when a miner privately builds a longer alternative history, spends coins on the public chain, and then releases a competing chain that omits or redirects the original payment.

Coinbase listed reorganizations ranging from four replaced blocks to a depth of 123 blocks. Its largest individual double-spend entries were 52,800 ETC and 52,200 ETC. Summing the 12 amounts in Coinbase’s event record produces the reported 219,500 ETC total. Three of the 15 reorganizations contained no double-spend, an important distinction between unusual consensus behavior and directly observed payment reversal.

Why exchanges reacted

A payment appearing in a block is not automatically final. Exchanges ordinarily wait for additional blocks—called confirmations—before crediting a deposit. A sufficiently deep reorganization can invalidate a deposit even after a service has treated it as settled, potentially allowing an attacker to withdraw another asset while retaining the original ETC under the replacement history.

That made confirmation policy an institutional defense rather than a technical footnote. Contemporaneous reports said Ethereum Classic representatives recommended that exchanges and mining pools require more than 400 confirmations. Kraken increased its ETC deposit requirement, while Poloniex disabled its ETC wallets. Those measures reduced immediate exposure but also delayed access and demonstrated that settlement assumptions differed across venues.

Ethereum Classic was especially relevant to the broader market because it used proof of work and shared the Ethash mining algorithm with the much larger Ethereum network. The January 7 episode showed that a blockchain could continue producing blocks while businesses surrounding it judged its recent history unsafe for settlement.

What remained uncertain on January 7

The precise cause was disputed. Bitfly characterized the event as a successful 51% attack, while an Ethereum Classic adviser raised alternative explanations involving selfish mining or Coinbase’s view of the network. Coinbase’s record demonstrated deep reorganizations and double-spends but did not independently identify the actor, prove the actor’s exact share of network hash power, or establish which businesses ultimately bore losses.

The approximately $1.1 million value was Coinbase’s 10:27 p.m. Pacific estimate for 219,500 ETC. Coinbase did not disclose the exact ETC/USD price source or conversion timestamp, so it should not be treated as a consolidated market valuation or realized loss figure.

The defensible January 7 conclusion is narrower: transaction histories accepted by Ethereum Classic participants were repeatedly replaced, Coinbase observed 12 associated double-spends, and major service providers responded by suspending transfers or demanding substantially more confirmations. Attribution, the complete loss distribution and the attack’s endpoint were not established within the event-day record.