Independent crypto announcement desk

Reader utility · 07

中文

Meansline

The meaning behind the market notice.

Chain reorganization tracker

Find the depth, then decide whether it could have reached you.

Fourteen documented events across seven networks, from a one-off client fault in 2010 to a five-hour finality halt in 2024. Each record separates the cause from the depth and from the consequence, and remains readable without JavaScript.

14 events shown

Client fault

Bitcoin · Value overflow incident

A validation bug was repaired by a 53-block reorganization

Depth: Roughly 53 blocks, from block 74638 onward.

What happened: A transaction exploiting an integer overflow created outputs far exceeding any legitimate supply and was accepted into a block. A patched client was published within hours and the corrected chain overtook the defective one.

What it demonstrates: The deepest reorganizations in Bitcoin's record were repairs, not attacks. The mechanism is the same either way.

Bitcoin Wiki incident record
Client fault

Bitcoin · 0.8.0 / 0.7 chain fork

A version boundary split the network into two valid-looking chains

Depth: A short-lived split beginning at block 225,430; resolved by pools reverting, not by an attacker.

What happened: A block produced by version 0.8.0 could not be processed by pre-0.8 nodes because of an insufficient Berkeley DB lock configuration. Large pools were asked to move back to 0.7 to restore one chain; 0.8.1 followed.

What it demonstrates: Deposits at major exchanges and BitPay payments were suspended and quickly restored, and at least one large double spend occurred during the split — by someone testing whether it was possible.

Bitcoin.org chain fork alert
Client fault

Bitcoin · BIP66 SPV mining incident

Half the hashrate built six blocks on top of an invalid one

Depth: Six invalid blocks on 4 July, then three more on 5 July.

What happened: The BIP66 threshold of 950 in 1,000 version-3 blocks was reached, a non-upgraded miner produced an invalid block, and miners not fully validating extended it.

What it demonstrates: The published advice was explicitly a confirmation policy — lightweight wallet, older Core and web wallet users were told to wait 30 confirmations more than usual. Large miners lost over 50,000 US dollars of income.

Bitcoin.org SPV mining alert
Majority attack

Vertcoin · 603-block reorganization

The depth was sized to a single exchange's confirmation rule

Depth: 603 blocks removed, replaced by 553 attacker blocks, at 15:19:47 GMT.

What happened: About 125 VTC — roughly 29 US dollars — was double-spent across five outputs, while the attacker collected 13,825 VTC in block rewards. Estimated attack cost was 0.5 to 1 BTC.

What it demonstrates: The depth matched a major exchange's ~600-confirmation requirement for the asset. Reorg depth is a targeting parameter, not a measure of severity.

Technical attack report
Majority attack

Bitcoin Gold · first January reorg

Fourteen blocks removed for roughly 19,000 US dollars

Depth: 14 blocks removed, 13 added, at 18:01:32 GMT.

What happened: About 1,900 BTG was double-spent. The estimated cost of producing the reorg was approximately 0.2 BTC — around 1,700 US dollars at the time.

What it demonstrates: When rented capacity costs a fraction of the payout, a confirmation policy is the only thing standing between a venue and the loss.

Technical attack report
Majority attack

Bitcoin Gold · second January reorg

Fifteen blocks cleared both of a venue's escrow periods

Depth: 15 blocks removed, 16 added, at 00:24:08 GMT, from the same attacker address.

What happened: About 5,267 BTG — roughly 53,000 US dollars — was double-spent.

What it demonstrates: The venue used six confirmations for deposits and twelve for withdrawals; both depths exceeded them. It subsequently raised the BTG withdrawal requirement to twenty confirmations.

Technical attack report
Majority attack

Ethereum Classic · first August attack

3,594 blocks reorganized over twelve hours

Depth: 3,594 blocks from block 10,904,146, running 12 hours and 12 minutes.

What happened: Roughly 5.6 million US dollars — over 807,000 ETC — was double-spent against OKX.

What it demonstrates: At this depth no confirmation policy is viable. The only workable venue response is to stop crediting the asset.

ETC 51-percent attack risk evaluation
Majority attack

Ethereum Classic · second August attack

4,446 blocks reorganized four days after the first

Depth: 4,446 blocks from block 10,935,622, running 15 hours and 37 minutes.

What happened: Roughly 3.3 million US dollars — 465,444 ETC — was double-spent against Bitfinex.

What it demonstrates: Two successful attacks in a week against different venues is the signature of a chain whose production capacity is cheaply available on the open market.

ETC 51-percent attack risk evaluation
Majority attack

Ethereum Classic · third August attack

7,278 blocks reorganized over more than a day

Depth: 7,278 blocks from block 11,090,590, running 26 hours and 20 minutes.

What happened: No double-spend total is documented for this event.

What it demonstrates: By the third attack most venues had suspended or restricted the asset. An attacker without a crediting counterparty has nothing to collect, whatever the depth.

ETC 51-percent attack risk evaluation
Protocol defence

Ethereum Classic · ECIP-1100 (MESS)

A fork-choice rule that treats deep reorgs as suspicious

Depth: Not an incident. A proposed defence with a ceiling requiring an attacker to sustain roughly 31 times the competing chain's difficulty.

What happened: Modified Exponential Subjective Scoring made nodes increasingly reluctant to abandon a chain segment they already held. Core-Geth proposed activation at block 11,380,000, estimated for October 2020.

What it demonstrates: The specification is now marked as replaced by a successor proposal, so read it as the documented 2020 response rather than as current ETC policy.

ECIP-1100 specification
Majority attack

Bitcoin SV · block re-organisation attack

Three competing chains mined at the same time

Depth: Observed maximum of 14 blocks, beginning at 11:46.

What happened: Bitcoin Association attributed the attack to the same actor behind attacks on 24 June and 1, 6 and 9 July 2021, and said it was working with law enforcement.

What it demonstrates: The recommended defence was for honest node operators to mark the attacker's chains invalid — social coordination rather than a protocol mechanism.

Bitcoin Association statement
Client fault

Ethereum · beacon chain seven-block reorg

A partial fork-choice rollout split validator views for seventy seconds

Depth: Seven blocks, 3,887,075 to 3,887,081, between 08:55:23 and 08:56:35 UTC.

What happened: The proposer-boost fork-choice change had reached only part of the network, so validators on different versions evaluated a late block differently.

What it demonstrates: Proof of stake does not eliminate pre-finality reorgs, and a multi-block reorg on a major chain is far more likely to be a rollout gap than an attack.

Reorg analysis and block-by-block reconstruction
Finality failure

Ethereum · two finality delays

The chain kept producing blocks and stopped finalizing them

Depth: No reorganization. Finality lapsed for about 25 minutes, then for over an hour the following day.

What happened: Attestations voting for old beacon blocks forced repeated beacon-state regeneration once a preventive cache overflowed. Participation fell to 40.9 per cent, then 30.7 per cent. Teku and Prysm shipped fixes.

What it demonstrates: No history was rewritten. What paused was irreversibility — which is exactly what a venue waiting on finalization depends on.

Prysm v4.0.4 release, 15 May 2023
Liveness failure

Solana · mainnet beta outage

Five hours in which nothing new settled

Depth: No reorganization. Block finalization halted at 09:53 UTC; consensus resumed at 14:55 UTC.

What happened: The fault was consistent with a bug identified while investigating an earlier devnet outage. Recovery required a coordinated cluster restart, with a patch released as v1.17.20.

What it demonstrates: A halt does not put completed transactions in question. It does make every deposit and withdrawal route on that chain inoperative until the restart completes.

Solana outage report