When Bitcoin was created, it was built on blockchain technology. All Bitcoin transactions are validated by so-called miners, in blocks that contain all new transactions since the previously validated block. Upon validation a block gets added to the blockchain. A blockchain is thus a (public) database for Bitcoin transactions. It is decentralized, as all computers in the network have a copy of the blockchain, which are kept up to date by passing around new blocks. Should part of the network go offline, then the remaining part will keep the money flowing. It was set up this way so that, in theory, it could not be controlled by a central authority like the Federal Reserve. When a significant amount of Vericoin was recently stolen from cryptocurrency exchange MintPal, it marked the first time developers would choose to deviate from the previous.
Vericoin and Proof of Stake
MintPal was the primary exchange for altcoin Vericoin. Vericoin uses what is called Proof of Stake (PoS) instead of Proof of Work (PoW), used by Bitcoin, Litecoin and Dogecoin. In traditional PoW mining miners compete to be the first to validate a block. The first to do so receives a fixed reward according to the “winner-take-all” principle. Effectively, it can be compared to a lottery that pays out once per block once it receives a winning ticket.
In PoS, blocks are minted instead of mined, and rewards are limited due to the concept of coin age. Coin age can be seen as a measure of accrued interest. The interest still gets paid out to only the first stakeholder to validate a block, but coin age is reset when this happens. To allow all miners to receive their interest, there is minimum coin age to be accumulated before interest is paid. If the interest rate is 5 percent per year, then a stakeholder with 1,000,000 coins would be entitled to receive 2.28 coins every 8 hours (the minimum coin age for Vericoin). As long as there is no eligible coin age, users do not participate in the lottery. Also, higher coin age typically gets an additional weight in the process, making it more likely to be paid out.
In order to receive interest, the entire stake must be used for minting in a hot (online) wallet. This can be done once per year to claim the accrued interest, or continuously. The advantage of the latter method is that also interest on top of previously received interest is paid, hence the effective interest rate is a bit higher on annual base.
MintPal Hacked
This is what led to MintPal making a crucial mistake. An exchange would normally only keep a fraction of all coins held in reserve in a hot wallet. The remainder would be stored offline in cold storage. This is a best security practice, which makes it unlikely for a hacker to be able to steal significant amounts of coins. But when MintPal got hacked, the hacker managed to steal 30 percent of all Vericoins in existence. The previous must mean MintPal was not following the best security practice for at least its PoS coins, and was staking most of its Vericoins in a hot wallet to the purpose of accruing interest. As 51 percent of the coin’s total supply would be required to execute an attack on the digital currency itself, it is not only a huge amount but also one that poses a serious security risk.
Transactions Rolled Back
To save both Vericoin and MintPal, the coin’s developers stepped forward and decided to implement a radical solution. The blockchain would be rolled back to a point before the attack, meaning that all transactions that took place afterward would be erased from history. The move was praised by some, but also condemned by others. Litecoin-founder Charlie Lee argued that the rollback should never have taken place according to his views on the responsibilities of a developer: “As developers of a decentralized crypto-currency, it is our duty to make sure that the network is secure and that Litecoin functions well as a easy-to-use and efficient currency. It is not in our rights to decide which coins belong to whom..”
The Fallout
It also reveals a new hurdle for cryptocurrency acceptance in general. After all, business transactions were not exempted from this roll back. Businesses could get in trouble when transactions for delivered assets or services are reversed afterward. Even if businesses use a merchant solution that immediately converts cryptocurrency to fiat, the loss could end up at the payment processor or further down the economic chain. Due to this, the loss of a single company (or MintPal in the Vericoin case) could end up damaging the entire economy. Of course, Vericoin put up a good argument for saving MintPal given that otherwise the entire currency could be at risk of being compromised. But on the other hand, perhaps PoS coins have no right to exist to begin with. If PoS results in putting the future of a currency in the hands of a company with apparently poor security practices, then something must be deeply flawed in the algorithm or the incentives that arise from it.
Ethics
Within just weeks from the Vericoin hack, another PoS coin is already experiencing a similar scenario. This time, five percent of all NXT coins were stolen from cryptocurrency exchange BTER. BTER immediately announced that it could not afford the loss, and sought to negotiate with the hacker. The negotiations ended with 100 BTC being transferred to the hacker to return the stolen NXT, but after the transfer was made the hacker disappeared again. At the same time a rollback was actively being considered as an alternative solution by the community, but even a Vericoin developer advised not to apply a rollback to the NXT case. The Vericoin developer argued that one person with a five percent stake is not as much of a security risk. In any case, there are no guidelines when to, and when not to perform a rollback, and ethics have therefore suddenly become a whole lot more important. This is not just down to the developers, as it should also be realized that a rollback has to be accepted by the economic majority of the network (as a software update) before it becomes effective.
Proof of Work
For PoW coins such as Bitcoin, stolen coins are not a security risk to the currency. To successfully attack a PoW coin, an attacker would need to gain control over at least 51 percent of the network’s total computational power. But even these PoW coins could, in theory, have their blockchain rolled back. The developers of Bitcoin have, however, already proven not to seriously consider such a solution. If they had, the default of Mt.Gox after 650,000 Bitcoins were stolen from the exchange earlier this year would have been the best moment to apply it. Similarly, Dogecoin developers did not act when online wallet service DogeVault was hacked and lost 280 million Dogecoins. Also in these cases, the network would still have to accept a rollback as well.
Conclusion
The conclusion would therefore be that cryptocurrencies are not as free from a central authority as many thought they were, although this will likely only impact Proof of Stake coins. In Proof of Work, a single person with a substantial amount of coins owned does not pose a risk to the future of the currency. A rollback would therefore not likely be considered by the developers, nor would the majority of the network accept the rollback. Proof of Stake coins could work on establishing an ethical framework for rollbacks, but it would be a Band-Aid solution to the fact that on this important area they simply fall short of Proof of Work coins.
