Ethereum Classic Attack Turns Proof-of-Work Risk Into Exchange Losses

Ethereum Classic’s deep chain reorganizations became a confirmed exchange-loss event on January 8, 2019, when Gate.io said an attacker had exploited rewritten transaction history and left the platform with a loss of approximately 40,000 ETC. The disclosure corroborated Coinbase’s earlier finding that repeated reorganizations contained double spends, turning a suspected concentration of mining power into a concrete test of transaction finality on a public proof-of-work network.

Gate.io reported detecting seven rollback transactions, four attributed to the attacker and involving 54,200 ETC. The exchange said it would absorb the resulting 40,000 ETC loss rather than pass it to customers. CoinDesk valued that loss at roughly $200,000 using a press-time ETC price of $4.97 on January 8. That conversion was a contemporaneous point estimate, not a daily close or a measure of total losses across every affected platform.

What Coinbase observed

Coinbase said its monitoring systems first detected a deep Ethereum Classic reorganization late on January 5, 2019, Pacific time. The exchange disabled ETC sends and receives while leaving buying and selling available. In an update timestamped January 7 at 10:27 p.m. Pacific—January 8 at 06:27 UTC—Coinbase reported 15 reorganizations, 12 containing double spends totaling 219,500 ETC, which it valued at approximately $1.1 million. Coinbase said none of its customer accounts had been affected.

Those figures measured the reorganizations visible to Coinbase, not an audited total of money successfully removed from exchanges. The 219,500 ETC figure therefore should not be read as Coinbase’s own loss or as a complete industry-loss estimate. Gate.io’s 40,000 ETC disclosure was narrower: it described the exchange’s claimed loss from transactions that initially appeared valid and sufficiently confirmed before the competing chain displaced them.

Why the reorganizations mattered

A proof-of-work blockchain selects the valid transaction history by accumulated work. If one actor commands enough mining power to build a competing history and overtake the public chain, previously accepted blocks can be displaced. A reorganization does not reveal private keys or permit arbitrary transfers from every wallet. It can, however, support a double spend when an attacker deposits coins with a counterparty, receives another asset or withdrawal, and then replaces the deposit with a competing transaction in the winning history.

That distinction made exchanges the immediate pressure point. Confirmation requirements are intended to reduce the probability that an accepted deposit will later disappear, but the Gate.io loss showed that a confirmation policy calibrated for ordinary reorganizations could be inadequate against an actor controlling a dominant share of effective hash power. Coinbase’s suspension demonstrated the other available defense: stop settlement until the chain appears stable.

The broader significance was institutional rather than merely technical. Ethereum Classic’s ledger continued producing blocks, yet exchanges had to decide independently whether those blocks provided sufficient settlement assurance. On January 8, the attacker’s identity, mining-power source and total proceeds remained unverified. Claims about motive or rented hash power were therefore hypotheses, not established facts.

Later context

Gate.io reported on January 12, 2019, that approximately $100,000 worth of ETC had been returned on January 10. The exchange said it did not know why the funds were returned. That later development does not change what was knowable on January 8: multiple exchanges had evidence of reorganizations and double spending, while the full scope and attribution remained unsettled.