Here I will refer you back to my answer to @DaveF (sorry for the initial mistake):

---

Okay, here we are talking about potential mitigation strategies. I also think that Bitcoin investors must be able to do something. The question is just what? (I'm personally still thinking that planning a switch to PoS themselves might seem like the best option, btw.)

While I agree that one might be able to do something with $10 billion, I'm not sure that trying to pay the "honest" miners more would be a very good strategy at all. My concern is that this would just immediately incentivize all miners to try to make it seem like an attack is underway, in order to cash in on this mitigation money as a large bonus to their normal earnings.

I guess the Bitcoin investors could try to buy mining farms directly, instead of simply raising the on-chain rewards. But that would then still incentivize such mining farms to help fund the attack (which I explain in my preprint paper can seemingly be done anonymously via smart contracts).

Last but not least, one also has to ask the question of whether the Bitcoin investors are really that cohesive when all any single investor has to do to avoid the threat, and avoid paying their share of the 'mitigation money,' is to just preemptively trade their BTC for ETH (or perhaps another PoS coin). With the shear amount of BTC that is traded each day on the blockchain, even the large players (at least most of them) should be able to make this move pretty quickly.

But what do I know about the fortitude and cohesion of the Bitcoin investors as a group: not much. This is only speculation on my part. What do you think in this regard?

Yes, I agree that the attack is unlikely to come from just a few rich individuals, and if the attackers form a large group of people, then it is sure to reach the public, I also agree with that.

So the point here on which we might disagree is the question of whether it would hurt the attackers if their plans become publicly known or not.

You argue that:

It is not unthinkable that all these institutions would try to search for the attackers and take them to court. But as far as I can see, I don't really think that they have much stake nor interest in this, first of all.

You argue that they would care about $650 billion. But it's not their $650 billion, and the Bitcoin investors knew the risk. (The risk of a 51% attack is described in the very Satoshi whitepaper.)

Second of all, I really don't think that they would have much of a case even if they tried. Besides what the aforementioned blog post says, consider this:

While the Bitcoin exchanges, mining farms, etc., are all subject to various laws (and have to do what they promise their customers), they have no control or authority over the blockchain protocol itself. No one has. This is the defining factor of what it means that the currency is 'decentralized.'

This means that anyone is actually free to declare what they think the Bitcoin protocol should be, at any moment. And the only reason why the Bitcoin protocol doesn't change so easily is due to the Nash equilibrium of the protocol, which means that as long as >50% of the miners agree on the same protocol, it will not be economically viable for any individual to start using a different protocol.

And that's it. The miners are not in any way obligated to follow the rules of the conventional Bitcoin protocol. Sure, mining farms are bound to follow that protocol if they have advertised that they will do so to their users. But even if they have, they can (with all likelihood) easily and quickly introduce another option to mine with a different protocol.

So this means that the attackers are just as free to declare that their protocol is actually the "right" protocol, and that the "honest miners" follow an (in their eyes) out-dated protocol. And if they do, they should, as far as I know, have just as strong case against the "honest miners," as the "honest miners" (and other institutions) have against them.


With this in mind, do you then agree that the line between "attacking miners" and "honest miners" is actually not legally meaningful (except in cases where a miner has agreed to a contract), as miners are not obligated to follow a specific Bitcoin protocol? Or am I missing something major?

And if you do, do you then agree that the would-be attackers don't actually really have to hide their intentions from anyone?

---

So do you think that the ASICs suppliers would make their costumers sign a contract not to use their ASICs in a 51% attack? And do you think that they will be able to ensure that willing miners can't get around those contracts?

By the way, can I ask what you think about existing miners joining the attack? (If the Ethereum stakeholders rewards them automatically via a smart contract (see my preprint), then it seems that anyone can join the attack at any time.)


(Let me get back to your other points in the same post in a little while.)

@tiCeR, thanks for a great post.

I think your point about ETH investors also owning BTC is a very good one. User @HeRetiK also brought up this point earlier:


I'm first of all afraid that I don't personally have much insight into whether ETH whales are also BTC whales, and vice versa. But I do think that this is quite likely.

My reply to @HeRetiK was, however, that if it is really true that a Goldfinger attack would only require a fraction of the Ethereum investors, namely something like 2%–6%, in order to for the attackers to start to break even in terms of costs and gains, then it could potentially be possible without these whales (of course assuming that these don't own it all).

And what's more, if there really is this potential to grow your crypto assets by something like 100% or more in this rival Goldfinger attack, then it might happen that some investors who have previously invested in both cryptocurrencies at the same time will start to trade a portion of their BTC for ETH, either because they fantasize about joining the attack, or just as a precaution if others want to do so.

But of course, at this point, this is all still just speculation.


To your point about a negative effect on ETH as a result of Bitcoin being attacked, I personally think this is one of the best arguments against the danger of a rival Goldfinger attack I have heard so far, and it is certainly a point that has been voiced by many users on this thread.

Historically it seems that the value of ETH follows the fluctuations of BTC. So a successful attack would thus require the Ethereum investors to first make an efficient campaign to communicate to the public that this attack vector only really affects PoW blockchains, like Bitcoin, and not really PoS blockchains in practice.

Now, I agree that the Ethereum and Bitcoin communities might be quite friendly at this point in time. But that doesn't mean that the Ethereum community don't already try to highlight all potential advantages of PoS over PoW to the public. And I personally find it quite unlikely that they wouldn't at some point also try to point out this potential "rival Goldfinger" threat, if the theory holds up. If nothing else, then at least in order to try to make the public feel more positively about PoS in relation to PoW.



I think you are right, but I do wonder: What can they even really do to stop customers from buying their ASICs? Even if the suppliers deny these costumers, what prevents the latter from just acquiring those ASICs through middlemen? Could they perhaps make their customers sign a contract not to participate in a 51% attack, or to sell them on to other buyers who will?

Well, since the attackers can just use a whole array of middlemen in principle, and since they can also in principle make it so that their mined blocks in an attack can't be traced back to them in the first place, it seems quite unlikely that such contracts would work, at least to me. What is your opinion on this?



I definitely think that it would indeed be very much illegal for them to change the protocol and make an attack without consent of the users. So if such mining farms are to participate in an attack, they would have to make it a choice for the individual user whether that user wants to join in the attack or not. (And they would also have to update their contract such that the participating users will also be owed their part of the spoils.)



Here's the thing, though: I don't really see why they would need to keep it a secret. I could be wrong, of course; I'm by no means an expert on legal matters. I just go by what I have read in this blog post: https://sites.duke.edu/thefinregblog/2022/12/28/legal-liability-of-a-51-goldfinger-cryptocurrency-attack, which argues that a 51% attack might not even be illegal, in the sense that it might not prosecutable in a court of law. (I definitely think that this is worth discussing more, however.)

If that is indeed the case, then it seems that the more rumors there are about the build-up of the attack, the better it would actually be for the ETH investors, as it might just make BTC investors migrate preemptively, which would only make the cost go down, in theory.  (This is of course assuming that they can indeed communicate successfully to the public that PoS is still safe, and that they can thereby convince some of the now uncertain BTC investors to migrate to ETH instead).


Ha, yeah, it's all quite theoretical at this point. But your inputs are valuable.

Again, a 51% attack is not market manipulation. My Bob–Eric example is not an arbitrage cycle; the crash only happens at the end after the reorg, not during the trading. This once again shows that you are only reading my posts so superficially that you don't even really catch any of the points. I can't work with that.

I still don't know if you are being troll on purpose, or if you are just not reading anything that I write properly, which is also poor behavior.

If Bitcoin does not crash after the first big steal using a long-range attack (1 reorg), then the attackers can just repeat the attack to steal even more.

But obviously, if the attackers can just keep coming back for seconds, this will halt the trade of Bitcoin, thereby making it useless as a currency, and it's value will drop. This is not just me saying this, but this is a standard assumption in literature.

You pretend like I have avoided some of your arguments on this thread, but I dare you to quote any of your earlier arguments, and I will quote you back a counterargument (one that I have already given on this thread).

But then you have to promise me to actually read my counterarguments this time around. (I have almost no patience left for you.)

You don't even deny that this was exactly the "delay service" you were talking about.

Bye, troll. Good riddance.

Just to hammer the point home, let me also mention something else, that I left out of my preprint, which is that when the attackers rewrite the ledger, they can also remove and rearrange the transactions of the any of the innocent traders in the same time frame.

This means that they can also make other traders inadvertently steal BTC in the same attack. Thus, they are able to make half the traders in the given time frame look as if they are accomplishes in the attack.

Since their ultimate goal is to cause a crash, it doesn't matter who steals the BTC, just as long as someone does, intentionally or inadvertently.

This relieves the attackers of having to trade the large quantities of BTC leading up to the long-range attack that we have just discussed on this thread, which is actually a significant improvement on this particular version of the attack vector since it then relieves them of having to make this activity appear normal, while keeping the secret that an attack is underway. 

Okay, I will accept that maybe you sincerely thought that I was talking about "implementing new delays." So I'm giving you the benefit of the doubt, even though you still ought to have paid better attention.

We are both talking about exchanges (and such) delaying the confirmation time (beyond the standard 6 blocks), which is indeed a standard and well-known thing that they can do. And each individual exchange/trader is indeed able to do it independently, and temporarily, whenever they want to.

Regardless, I've explained why that wouldn't help anything in a long-range attack. Now, you both ask me to once again do the (easy) catch-up math, and you also explicitly state that an attack would require several reorgs, "otherwise they wouldn't be able to steal enough to make it affordable."

This all shows that you either don't know what a long-range attack is, or have somehow missed the point, even after this long conversation.

Okay, I'll forgive you for that, but then you better listen more carefully now:

In a normal replay attack, an attacker tries to pay for other assets/currency/etc. with BTC, then reorgs the ledger, and then quickly tries to cheat another party to sell some other assets/currency/etc. for the same BTC, before they notice that a big reorg has happened, thus "replaying" the same BTC.

If this were the kind of attack we were talking about here, then you would be right: The attacker would not be very likely at all to make this attack worth it, namely since exchanges and such would likely notice the large transfers on the blockchian and choose to temporarily require a longer confirmation time (more than 6 blocks, i.e.), until that large transfer is more sure to be finalized. (This is the "delay services" that you are also talking about; we are talking about the same thing here.)

However, this is not the kind of attack that I'm talking about. Note that in my Bob–Eric example, Alice ends up with BTC, not other assets/currency/etc. And note also that Alice is making exactly one reorg of the ledger in this attack. (And note that she could have made many more trades in principle, even in parallel rather than one at a time, and trade more BTC each time.)

This kind of attack is known as a long-range attack, where the goal is not to replay non-BTC assets/currency/etc, but to steal BTC alone.

Now, it is normally assumed that Bitcoin would crash as a result of such an attack (unless honest miners somehow manages to regain a majority of the hash rate after the attack and then soft-fork the blockchain back to the original chain), which means that long-range attacks haven't been much feared before, since they have thus also been deemed as very unlikely to be profitable for the attacker, and therefore "who would do it?"

The so-called 'Goldfinger attack,' however, gives a potential reason why attackers might do it anyway: Either they could be politically motivated, and/or act on behalf of some government/institution, or the attackers could perhaps take large short positions (I assume you know what that is). In particular, if they do the latter, this might then potentially make up for the fact that Bitcoin would crash as a result of such a long-range 51% attack (or another potent 51% attack, more on that in a minute).

Because if the attackers have a reverse stake in Bitcoin, and will thus profit from a crash, then this turns it into a win-win situation, as I have already explained: Either Bitcoin doesn't crash, in which case the attackers can now spend all their stolen BTC at will, perhaps after some whitewashing first, or they profit from the crash itself due to their reverse stake.

And as you know by now, I point to the fact that rather than trying to take such a large short position in order to make this work, the attackers might instead be (or be funded by) stakeholders in a rival blockchain, and one that does not use a PoW protocol itself, hoping to profit from the fall of the competitor.

Now, I must also add to all this: A long-range attack is not necessarily the only kind of 51% attack that could work for such a (rival) Goldfinger attack. A sustained 51% attack that DoS'es Bitcoin for months or years might also do the trick. But let's put this discussion on the shelf for now until you have shown that you now finally understand how a long-range Goldfinger attack could be profitable for the attackers (assuming that they can profit from a crash of Bitcoin in the first place, of course, and also assuming Bitcoin does not take any new steps to mitigate such an attack).   

On second thought, maybe there is a possibility that he could stay clear of the law, if only he can successfully mask all his mining activities, both before and after the attack. (I don't know exactly how easy/hard this would be.)

The point is that attackers can also rewrite the transactions of innocent traders, thus including them (involuntarily) in the steal. (This is something that we haven't yet touched upon in this thread.)

So attackers could in principle target e.g. CZ to make him look guilty as well. And on the other hand, this possibility also gives deniability to any actual accomplices. So CZ might also be able to deny having been an accomplice.

Just a thought. However, the more attackers take part in the attack, the easier it will be for them to deny their part in it afterwards, in any case.

Well, unless Bitcoin somehow retains its value after the attack (in which case he could just steal, steal, steal), he would either have to be smart enough to be able to end up with other assets/products/currency that don't lose their value, and also get away with that (staying anonymous or within the bounds of the law somehow). Or he would have to take a large enough short position to cover the loss from the crash of Bitcoin, which would probably also be quite a tall order, as far as I know.

But rather than taking a large short position, he could also invest in ETH instead, and hope that a fall of PoW will elevate Ethereum by a large enough factor to cover his costs (and future loss of revenue from his ASICs).

Now, the thing about this latter option is that if it succeeds, it will also make all other Ethereum investors besides him have their ETH grow in value by a similar factor. So by e.g. creating a smart contract like the one described in my preprint, he might be able to get some of these other Ethereum investors to help fund the attack, thus lowering his own costs and risk associated with it.

If enough Ethereum investors joins in, the risk of losing $6B–$16B might be worth the potential gains (of upwards of a trillion dollars) if the plan succeeds.

But yeah, not saying that investing in ETH is the only option (let alone paying the miners in ETH).

@franky1, it's clear that you are not really listening.

Here in this comment:
you are saying that "no, it isn't about extending the confirmation time," and then in the same breath you saying that it is about "delay services" instead. Unless you can somehow explain to me that "delay services" isn't about 'extending the confirmation time,' I will regard you as being dishonest.

You also give me a "hint" that:
This either assumes that attackers need to do several reorgs in order for the attack to work, or that the attackers are somehow reliant on being accepted by specific crypto exchanges after the attack. If you had paid attention (i.e. to me explaining about the long-range attack above, or the fact that the ultimate goal is to crash the market), you would know that neither of these things are relevant. So either you are not paying attention or you are being dishonest.

As for your whole tactic of avoiding argument by pretending that you know something that I don't while being unwilling to say what that is, and at the same time pretending that I'm the one not listening to your arguments while hardly doing anything to point us back to whatever arguments that would be... Well, I don't think I'm the only one who sees through that tactic.

Please stop that behavior, or just leave the thread.

You know that I already did that exact math:




Isn't this exactly that 'extend the confirmation time' idea I was talking about? You know that this isn't going to do anything to prevent an attack on that scale, as I've already made clear:
Or what exactly are those "other mitigation factors" that you are talking about? 




Just saying that "I know some much better ways to target Bitcoin than your un-thought-out one" gets us exactly nowhere. If you sit on some arguments why the 'Rival Goldfinger attack' wouldn't work that you haven't yet divulged, then do so. Or if you know of another way that is sure to make Bitcoin crash... Well, I guess make another thread about it.

It's not really 'market manipulation' in any way. It's more like an 'adversarial exposure of a security flaw in the technology of a competitor,' and arguably 'sabotage' if they really go through with a full attack.


Name one mitigation strategy that you have mentioned above on this thread that isn't either 'extending the confirmation period,' which as I've explained doesn't really seem to help much since it cannot be done retrospectively, or would mean a departure from pure PoW, which would be a remarkable option as it would go against Bitcoin's protocol as is.

Also if you like, feel free to mention any other interesting ones that you can think of, as this discussion was the main intention behind this thread.

This is a good point. If your wisdom is well-founded, then Bitcoin might not have anything to fear.

I guess we really ought to hear out the Ethereum community of their opinion(s): Would a fall of PoW be good for Ethereum or not?

@franky1, I'm very sorry if I misunderstood you. But you first of all start your reply by saying "here's the thing," which already seems to imply at least that you don't necessarily disagree with my point. Then you go on to write that there is in fact an even better way for attackers to target Bitcoin and make a lot of money. You follow that up with to comparative statements, saying that you way is better than the 'Rival Goldfinger attack,' and that the latter is more costly, slower, etc., than your way.

This is a complete change of the conversation. Now we are not talking about the feasibility of the 'Rival Goldfinger attack,' but of its efficiency compared to some arbitrage venture, that you have by the way only brought up in the same post. (You have talked about arbitrage before, but as I recall, you have never stated that it is a more lucrative way to target Bitcoin as part of this discussion.)

Why do you even bring up this arbitrage venture as a better way to target Bitcoin if you are still not agreeing (against the conventional wisdom) that a 51% attack would be severely harmful to Bitcoin? 

But oh well, apparently bringing up your arbitrage venture idea was only a somewhat unrelated tangent to the discussion (?), and you still think that a 51% attack can't be profitable (given that the value of Bitcoin doesn't crash).

You seem to be hung up on the confirmation time. But even if the attackers exchange their BTC back and forth for USD (rather than trade them perhaps more quickly for tokens or ETH), you still agree that it only takes a few days at max for each confirmation. Now, whatever confirmation period there is, this is something that all traders have to deal with. Yet there are still being traded BTC worth billions of dollars each day, despite these long confirmation times! You must agree that with enough money and backing, there is nothing stopping the attackers from trading many millions each day on average (and in principle, it seems that they might be able to trade upwards of billions).

So do you see that we don't really have to discuss the current confirmation time here; not when we are talking about a long-range attack that could rewrite months of the ledger?

Also, you seem to want me to research your arbitrage venture idea, which I definitely want to do if it indeed only takes 10 minutes, and constitutes a business that completely blows all other investment options out of the water, which, you must admit, you make it sound like. I'm sure more people on this forum would love to hear more about this idea, even if it is only half as good as you make it out to be. (But maybe you should create another discussion thread for it, though, if it is not directly related to this one?)

Ah, I see. You are saying that the devs wouldn't try to support an attack, not that they necessarily would try actively to prevent it? In that case, I think you're probably right.


Ha, yeah, I'm sure it would shake things up somehow...

(But in all seriousness, I would personally rather see a good, broad discussion of the risk first, such that no investors are caught unaware of it.)

This is a turn of events.

You now seem to finally accept that a 51% attack could cause severe damage to the value of Bitcoin, thus ending our long discussion on this thread.

And not only that, you even claim that there are other, more efficient ways of doing this, and for someone (e.g. an investment fund) to easily and rather quickly make billions, at a low risk, starting with $16B in capital.

In fact, these ways are so trivial that someone like me (with a background in physics and computer science, by the way) should only spend 10 minutes in order to figure them out.

Maybe I'm blind, but I'm not too convinced about these latter claims myself quite yet. Feel free to elaborate. Also, I wonder what other people on this forum thinks about them?

However, I'm glad we finally seem to agree that a 51% attack could cause severe damage to Bitcoin.

Perhaps you (and others) would be interested, then, in discussing what Bitcoin could do, if anything, to mitigate such an attack?

User @d5000 has already given some suggestions above in this regard.

Well, I think you are still forgetting about this part:

In reality, "Alice" could be a great number of people, all making these kinds of trades at once. Since the transaction volume can easily reach $15B (not just $1.5B) on a normal day, they would seemingly be able to trade a billion each day, in principle, without raising major suspicions.

Not that they need to trade that much each day, by the way: Buying and selling something like $100M worth of bitcoin would also be enough if they just reverse enough blocks, as this would make them close to $100M for each day of the ledger that they rewrite. More precisely, they would earn $100M worth of bitcoin (using the pre-attack rates, of course), minus the mining costs of the attacking miners, plus the mined bitcoin.

Do you now see the potential severity of a successful a 51% attack?

Good, at least we agree on that, then.



We are not talking about them changing the algorithm. We are talking about replay attacks (steals).



This is simply false. It is not only widely accepted that replay attacks can happen (as long as the attacker has the money/power to do it), but they have also happened in reality to smaller PoW coins.

Somebody else, please back me up on this.




Here you are ignoring/not considering this earlier reply:
And you are ignoring/not considering my earlier point that when the attackers profit from (or believe that they are profiting from) a crash, they don't have an incentive to keep any other assets/products, but can keep their stolen bitcoin after the attack. (It's a win-win: Either bitcoin keeps its value, and they get rich, or it crashes, which is what their benefactors is trying to reward.)




This idea goes against the principles of PoW. Somebody else, please back me up on this.

Now that I've thought about it, I think it might be dangerous for Bitcoin investors to switch to a third PoS coin (fully or partially) as a solution. The danger is that if they are not extremely coordinated, the first investors to buy the third altcoin might get them for cheap whereas the last ones to move will have to pay a lot more BTC for them. This could cause a great shift in the wealth between the individual Bitcoin investors.

It would probably be much better to them create a brand new PoS coin and simply copy all the wallets and balances from Bitcoin to that one. Note that this is similar to making a PoS hard fork of Bitcoin in practice. Afterward the investors can trade the new coin in order to establish its value compared to Bitcoin (the PoW version) via the normal market forces.

What do you think of that?