Bitcoin wallets vulnerable to double-spending bug

The cryptocurrency Bitcoin has not been without its problems. There have been numerous hacks leading to the loss of millions of dollars, and Bitcoin mining tool Epic Scale became embroiled in a crapware scandal with uTorrent. The latest problem to hit the digital currency is a double-spending bug.

As the name suggests, this essentially makes it possible to spend the same Bitcoins twice, and it stems from a problem with a planned upgrade. An issue with some Bitcoin miners means that tests that usually prevent double-spending are not correctly performed. The problem was discovered on 4 July as many Americans were busy celebrating Independence Day.

Double-spending is supposed to be thwarted by a safety mechanism which checks the block chain (or transaction database) to check whether any given Bitcoins have been spent or not. Some Bitcoin miners are now generating invalid blocks, making it impossible to guarantee that currency can’t be spent more than once. The Bitcoin Foundation assures users that all transactions confirmed by 15:00 on 4 July are safe.

An announcement on the Bitcoin website explains:

For several months, an increasing amount of mining hash rate has been signaling its intent to begin enforcing BIP66 strict DER signatures. As part of the BIP66 rules, once 950 of the last 1,000 blocks were version 3 (v3) blocks, all upgraded miners would reject version 2 (v2) blocks.

Early morning UTC on 4 July 2015, the 950/1000 (95%) threshold was reached. Shortly thereafter, a small miner (part of the non-upgraded 5%) mined an invalid block--as was an expected occurrence. Unfortunately, it turned out that roughly half the network hash rate was mining without fully validating blocks (called SPV mining), and built new blocks on top of that invalid block.

Note that the roughly 50% of the network that was SPV mining had explicitly indicated that they would enforce the BIP66 rules. By not doing so, several large miners have lost over $50,000 dollars worth of mining income so far.

Despite adoption by a number of big names -- including Microsoft -- many people remain skeptical of the digital currency. But there are others who believe cryptocurrencies are the future of online, and real world, transactions. With the economy failing in Greece as the country teetering on the verge of crashing out of the EU, some Greeks have converted their money into Bitcoin in an attempt to minimize the risk of devaluation.

At the moment there is no news that the problem has been exploited by anyone, but unless the vulnerability is addressed, it's only a matter of time before this happens.

Photo credit: Lightboxx / Shutterstock