Bitcoin exchange halts withdrawals after cyber-attack

Bitcoin transaction A flaw in Bitcoin's software is proving more problematic than had been suggested

Related Stories

Bitstamp - one of the world's largest Bitcoin exchanges - has halted withdrawals after coming under cyber-attack.

The Slovenia-based firm said the culprits had exploited a bug in the virtual currency's underlying software to carry out the assault.

It is the second exchange to suspend operations. Tokyo's MtGox took a similar measure on Friday.

A third, Bulgaria's BTC-e, has warned that some transactions may be delayed.

Like Bitstamp, it cited a denial-of-service (DoS) attack as the cause.

Bitstamp Bitstamp is the second exchange to halt withdrawal of bitcoins

The Bitcoin Foundation - a group of developers who maintain and promote the cryptographic code on which the currency relies - said that it was creating workarounds and fixes to tackle the issue.

It added that people who had funds stored with the affected exchanges should know that their savings were safe, albeit "tied up" for the time being.

"This is a denial-of-service attack; whoever is doing this is not stealing coins, but is succeeding in preventing some transactions from confirming," wrote Gavin Andresen, chief scientist at the foundation.

"It's important to note that DoS attacks do not affect people's Bitcoin wallets or funds."

How Bitcoin works

Bitcoin is often referred to as a new kind of currency.

But it may be best to think of its units being virtual tokens rather than physical coins or notes.

However, like all currencies its value is determined by how much people are willing to exchange it for.

To process Bitcoin transactions, a procedure called "mining" must take place, which involves a computer solving a difficult mathematical problem with a 64-digit solution.

For each problem solved, one block of bitcoins is processed. In addition the miner is rewarded with new bitcoins.

This provides an incentive for people to provide computer processing power to solve the problems.

To compensate for the growing power of computer chips, the difficulty of the puzzles is adjusted to ensure a steady stream of about 3,600 new bitcoins a day.

To receive a bitcoin a user must have a Bitcoin address - a string of 27-34 letters and numbers - which acts as a kind of virtual post-box to and from which the bitcoins are sent.

Since there is no registry of these addresses, people can use them to protect their anonymity when making a transaction.

These addresses are in turn stored in Bitcoin wallets which are used to manage savings.

They operate like privately run bank accounts - with the proviso that if the data is lost, so are the bitcoins owned.

Mutated IDs

The cause of the problem is an issue called transaction malleability.

It involves someone changing the cryptographic code - known as a transaction hash - used to create an ID for the exchange of funds before it is recorded in the blockchain - a database of every transaction carried out in the currency.

On Monday, MtGox had suggested that this technique could be used to fool its systems into repeatedly making a payout because it would seem that it had not occurred.

The Bitcoin Foundation's initial response was that transaction malleability had been known about since 2011, and that MtGox should have prepared for this when developing its own customised software, which was now proving vulnerable.

"This is something that cannot be corrected overnight," wrote Mr Andresen.

But while other exchanges are not complaining about the risk of making unauthorised payouts, it appears their systems can become overwhelmed if they receive too many "mutated versions" of the transaction IDs.

"This is a denial-of-service attack made possible by some misunderstandings in Bitcoin wallet implementations," said Bitstamp's blog.

"These misunderstandings have simple solutions that are being implemented as we speak, and we're confident everything will be back to normal shortly."

The Bitcoin Foundation now says its members and developers from a number of exchanges are working "collectively and collaboratively" to tackle the problem and allow withdrawals to resume.

'Wake-up call'

One bitcoin is currently trading for about $665 (£402). That is well below the $830 level it was at last Thursday, reflecting investors' concern at the news.

However, one expert said the virtual currency should emerge from the attacks more robust than before.

Bitcoin logo Bitcoin was trading for a high as $1,242 last year

"Obviously it's a bit more serious than was initially thought - it was originally believed that it was just a problem at MtGox because of the way they had set up their systems," Emily Spaven, editor of the news site Coindesk, told the BBC.

"The view from developers is that the exchanges should be processing bitcoin withdrawals again within 48-72 hours, though the wider issue of transaction malleability will take longer to address.

"It's been a bit of a wake-up call to get this issue fixed. I suppose they previously thought it wasn't that big a deal."

More on This Story

Related Stories

The BBC is not responsible for the content of external Internet sites

More Technology stories


Features & Analysis

BBC Future

(Science Photo Library)

Nasa’s amazing airport simulator

How to train 21st Century controllers


  • A robotClick Watch

    The latest in robotics including software that can design electronics to solve problems

Try our new site and tell us what you think. Learn more
Take me there

Copyright © 2015 BBC. The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.