The scope of this attack clearly makes it an organized effort. While it is possible that some lone guy is figuring out the flaw and how to take advantage of it, the fact we are needing more than one skillset and resources more indicates a team is involved.
Theoretically if you guys didnt notice the strange stuff on the blockchain and polo went on a fork, could they have just made many small withdraws over a week and drained the polo acct? The timeframe and resources required for this doesnt seem like some statment attack to cause a fork and go "ha ha", but where financial gain is involved.
If so, the list if suspects as being involved in this would be polo accts that were involved in accumulating recently (which I remember seeing talked about) and probably these were also trying to do the double spend while on the fork.
So, maybe the attack was against polo?
James
Nope - bear in mind that basically without any action from us the "bad" fork died after 35 minutes. It still exists, it's just stuck at block 202647 and won't proceed. This would have happened even if we hadn't noticed it, so there's little they could have done to have any long-lived attack.
then this makes no rational sense....
They clearly really understand the codebase
This indicates they wrote it or they have studied it extensively, I cant see anyone just randomly finding this and making elaborate attack.
Is there some "cascade" issue that having this fork could trigger?
Like dominos, the fork is the first and that makes an opening for another edge case?
It just seems like 100x more effort for just making a temporary fork. Any chance that a many blocks could have been mined consecutively without actually mining due to this fork, directly or indirectly.
There just has to be a financial motive for this. only thing makes sense
James
I think its possible it didn't
quite work right. As you point out it was elaborate and had a lot of parts. Maybe it malfunctioned a bit. That would fit with the stealthiness that doesn't really serve any other purpose other than to exploit something once it kicked in.
Or it wasn't (directly) economically motivated to attack an exchange, perhaps to simply attack the coin directly (especially if they underestimated us and didn't think we could fix it).
But we are still just guessing.
As for the fork it is completely dead. We will put in a checkpoint on the valid fork so no chance of ever bringing that one back to life.
As for other bugs/exploits, as I said a page or two back, we can never rule that out. All we can do is work to improve the code.