I think you missed the point of me posting that graph, which indicates that something has been going on for ~8-9 months, not ~3,000 blocks. If you watch the chain, it's quite indicative of a netsplit as transactions are pooled from the diff attacked chain onto a "just barely longer" chain, and then attacked for 30+ blocks (the difficulty adjuster length) immediately. Mining then stops until it happens again, presumably because the "just barely longer chain" is on a netsplit with multiple nodes in contention.

Maybe their connection can't handle the onslaught of incoming blocks, or there are multiple nodes serving miners work when the attack occurs? I don't know.


Who were they stolen from? The diff attacker? And where did they go? Like Funkenstein, I see no double spends, and I see no unconfirmed transactions. Just a diff attacker and a netsplit.

If it was a malicious attacker, I'd expect to see some extraordinarily large malicious spends, not valid reorgs with valid transactions in them. Satoshi deemed the chain with more trust (not more blocks) as the main chain, simply because a valid long-term miner will win outright simply to cover the array of strategies that people will try; including what you're seeing here. From that standpoint, neither chain is malicious and there is no attacker, but a chain with more trust that wins outright. I'll let people judge for themselves, though.

I looked on the block explorer for a large reorg, but I didn't find it. There's not many transactions on chain, so it's hard to tell where the splits occur, so I went through the last 4,000 or so blocks:
359306: http://explorer.woodcoin.org/block/8c5da867aeed8afd323de11e73e7b92fc90bd9d090fe5e7fd11c913b0e5cfd2e
358947: http://explorer.woodcoin.org/block/dbc7a64fbf3242c1d2837783925c5c90203381a7b19ff722c0fb9c9c9bb42ebd
358932: http://explorer.woodcoin.org/block/30e197100ae71b14242d13845d99c7d36108d8a6234a70bc28ca11b8e767ffc8
358598: http://explorer.woodcoin.org/block/e9182271fe244a2494a565fda1a2bcf83c217697d41332883566e12925bd9622
358560: http://explorer.woodcoin.org/block/ccdb8889eb82a3befda373c6e706fb0188d82421d324aea052eac2010a4e4544
357986: http://explorer.woodcoin.org/block/9767225db64cd68810e77160c8bdb7d7eb40dd8979b801b91bce9b641ac7c602
357391: http://explorer.woodcoin.org/block/b5e4b84e7266cec9ac8a3414c09c2ab85e92cda037182ece20d0b69401ab9669
357252: http://explorer.woodcoin.org/block/c025e43de9f27c472ff5cf3c8dd194424c27c469dce0f429e80f49a822e8782c
356860: http://explorer.woodcoin.org/block/85b6e1ac53743844c245d8532d3c8d767bbf5434b51b637e27cfad58ff8e011c
356602: http://explorer.woodcoin.org/block/8ad174df2a338014e84dea6241d2f8d23df618ec36c72acea37196b9aefc0f8e
356540: http://explorer.woodcoin.org/block/87d796fecc1b2493c6c273931463fe65de465ce546a6f2a786ab58956ec575dd
356333: http://explorer.woodcoin.org/block/6af22fad10f7b10792b7b680c6ac0bc60a475b1b45b4aee0395b21f51b55e55a
356197: http://explorer.woodcoin.org/block/adc12cad7092154cbef9e7027d03674bfa8713f4fff700720fe1ab4216ccae84
355892: http://explorer.woodcoin.org/block/ed9754c1d6f6096e006575f20e16fa7e8ad5c044a39c12bd588dcb06d22c48ed
355879: http://explorer.woodcoin.org/block/35b5aeae99f0c4182bf24f5297e99d2f7df0e69e2f30d45bf8239ff72775f174
355864: http://explorer.woodcoin.org/block/02bd02c3978b401ca1b28397a9d5ba1198e9e14763b2d21f252914225d0816df
355647: http://explorer.woodcoin.org/block/9ef99c7ba91b4fd2d8ccf3cefef69d37b4cb9da0c25475da9b96ba57e5cb27fa


Why not 8 months ago when the diff started roller-coastering? The diff attacker could just as easily mine for a bit longer and double spend the mined coin, but they haven't.

If anything, they should just up the amount of confirms it takes to get on the exchange, considering this kind of contention is happening, and probably has been for a while.