Vertcoin suffered a 603-block reorganization in a 51% attack

Vertcoin experienced a deep blockchain reorganization on December 1, 2019, exposing how rented computing power could threaten a smaller proof-of-work network even after it changed its mining algorithm to resist specialized hardware.

At 15:19:47 GMT, 603 blocks disappeared from Vertcoin’s accepted main chain and were replaced by 553 attacker-produced blocks with greater accumulated proof of work. The incident was described as a 51% attack because the attacker temporarily controlled enough effective mining power to build the chain that Vertcoin nodes accepted. That label does not establish that an observer measured an exact 51% share.

The episode mattered beyond the amount directly double-spent. It tested the practical finality of transactions, the effectiveness of exchange confirmation policies and the assumption that resistance to specialized mining hardware necessarily produces a secure network.

What the network record showed

Vertcoin lead maintainer James Lovejoy documented the incident on December 2, 2019. His analysis identified five double-spent outputs totaling approximately 125 VTC. The outputs came from coinbase transactions—new coins created as mining rewards—and were redirected after the attacker’s chain displaced the previously accepted history.

Lovejoy also reported that Bittrex required 600 confirmations for Vertcoin deposits. The 603-block reorganization extended just beyond that threshold, making the exchange a plausible target. He said he had warned Bittrex and that the exchange disabled its Vertcoin wallet while the competing chain remained private. No surviving Bittrex notice in the reviewed record independently confirms the timing or reason for that action, so those details remain attributed to Lovejoy.

The evidence does not establish that Bittrex or its customers lost funds. Lovejoy presented two possibilities: the attacker may have abandoned an intended exchange double-spend after the wallet was disabled, or the operation may have been sabotage or a proof of concept. The attacker’s identity and motive were unknown.

ASIC resistance was not majority-attack resistance

Vertcoin had adopted the Lyra2REv3 proof-of-work algorithm after attacks against its network in 2018. The design was intended to discourage application-specific integrated circuits, or ASICs, and preserve mining access for general-purpose graphics hardware.

The December 1 event demonstrated a different security problem. A network can make specialized hardware less useful while remaining vulnerable when enough compatible hash power is available for rent. Lovejoy reported that a miner noticed sharply higher Lyra2REv3 rental prices on November 30, 2019, and that workers connected to NiceHash were receiving work for Vertcoin blocks that had not appeared on the public chain.

Those observations were strong circumstantial evidence that rented hash power produced the private chain. They were not proof that NiceHash knew how the rented capacity would be used, nor did they independently identify the renter.

Why exchanges had to care

Proof-of-work settlement is probabilistic: additional blocks normally make a transaction harder to reverse. A reorganization deeper than an exchange’s confirmation requirement undermines the operational rule used to decide when a deposit is final enough to credit.

The Vertcoin incident therefore highlighted an institutional mismatch. A fixed confirmation count can appear conservative while still being inadequate if an attacker can economically acquire enough compatible mining power. Exchanges accepting smaller proof-of-work assets had to evaluate available rental capacity, network hash rate and deposit value—not confirmations alone.

The reviewed sources do not establish a broad cryptocurrency-market reaction on December 1, 2019, and this reconstruction makes no price or trading-volume claim. The verified consequence was narrower but significant: Vertcoin’s transaction history was rewritten, five outputs were double-spent, and the network’s exchange-facing security assumptions failed a live test.

Later context

CoinDesk and Bitcoin.com reported the incident on December 2, 2019. Research published by the MIT Digital Currency Initiative in May 2020 later described independent monitoring that detected the same 603-block reorganization and characterized it as more than 25 hours of reversed block time. That later study corroborates the incident but does not change what participants could establish on December 1, 2019.