I posted a few things in their discord server showing what happened but was kicked out for it. It is pretty easy to see the blocks that were printed. Just go to their explorer and look at all the blocks that were mined when the network was stalled and just inserted after. The blocks that were instant mined start at block 64885 and end at block 78340. It is supposed to take almost 3 weeks to mine that many blocks but instead they were mined over a short attack period using minimal hashrate. They were definitely attacked but they don't want to admit it and when they do admit to it they say that means people are scared of them. No it means you don't know how to fork monero properly and are using an easy to attack difficulty algorithm for a small coin.
Block: 64786 timestamp: 1543718265, difficulty: 2092409798, nethash: 17.44MH
Block: 64787 timestamp: 1543718267, difficulty: 2095121665, nethash: 17.46MH
Block: 64796 timestamp: 1543718291, difficulty: 2189638825, nethash: 18.25MH
This is a small sample from the timestamp attack. The attacker was manipulating the block timestamps to be 2-3 seconds apart. As you can see the difficulty was high and nethash was at 17-18MH/s during the attack. The point of this attack was to cause difficulty to rise way higher than it should have. With the timestamps being 3 seconds apart the daemon thinks there is about 700MH/s mining. This caused difficulty to spike and scared off all the people mining as it was costing way more in power to mine the coin than you would receive in rewards.
This attack gave the attacker a few days to execute their real attack which was to print 14k blocks worth of rewards. They then spent the next 2 days roughly mining the coin while not connected to the rest of the daemons. During this time they changed the coins settings to make it so blocks were only 1 second apart. They then mined on their own chain printing about 14k blocks using roughly 3-4KH/s of hashrate for most of the blocks.
height: 78000, timestamp: 1544059736, difficulty: 377488
height: 78001, timestamp: 1544059738, difficulty: 377069
height: 78010, timestamp: 1544059745, difficulty: 373247
That is 10 blocks mined 9 seconds apart with a nethash of 3.1KH/s. After mining all these blocks they reconnected to the network and caused a huge reorganization. To make it so their chain was the main chain they had to make sure total difficulty of their chain was larger than the current main chain. Since they had stalled the blockchain the miners mostly abandoned the coin leaving roughly 200KH/s on the chain. So lets say to be safe they rented 300KH/s for 2 days. At roughly .09BTC/MH/day nicehash price this part of the attack only cost them about 0.05BTC which is about $210. The timestamp attack went on for a few hours and most likely cost about the same. So it cost them 0.1BTC to attack the coin and mine 840,00 safex. Assuming they sell for at least 1000 sats each which is less than the price they are currently selling for the attacker will end up making about 8BTC off of this attack.
If Safex continues to use a 720 block difficulty window and stay on the same algorithm as Monero these attacks will likely continue. Even if they don’t there will still be the cyclical mining where people use nicehash when difficulty is low to mine the easy blocks then stop when difficulty rises and lets the regular miners be stuck mining the higher difficulty blocks. Then when nethash drops again the nicehashers will come back.