More than $300m of cryptocurrency has been lost after a series of bugs in a popular digital wallet service led one curious developer to accidentally take control of and then lock up the funds, according to reports.
Unlike most cryptocurrency hacks, however, the money wasn’t deliberately taken: it was effectively destroyed by accident. The lost money was in the form of Ether, the tradable currency that fuels the Ethereum distributed app platform, and was kept in digital multi-signature wallets built by a developer called Parity. These wallets require more than one user to enter their key before funds can be transferred.
On Tuesday Parity revealed that, while fixing a bug that let hackers steal $32m out of few multi-signature wallets, it had inadvertently left a second flaw in its systems that allowed one user to become the sole owner of every single multi-signature wallet.
Cryptocurrencies are an alternative way of making payments to cash or credit cards. The technology behind it allows the ‘money’ to be sent directly to others without it having to pass through the banking system. For that reason they are outside the control of governments and are unregulated by financial watchdogs – and transactions can be made in a way that keeps you reasonably pseudonymous.
If you own a crypto-asset you control a secret digital key that you can use to prove to anyone on the network that a certain amount of that asset is yours. If you spend it, you tell the entire network that you have transferred ownership of it, and use the same key to prove that you are telling the truth. Over time, the history of all those transactions becomes a lasting record of who owns what: that record is called the blockchain.
Bitcoin was one of the first and biggest cryptocurrencies and has been on a wild ride since its creation in 2009, sometimes surging in value as investors have piled in – and recently crashing back down.
Sceptics warn that the lack of central control make crypto-assets ideal for criminals and terrorists, while libertarian monetarists enjoy the idea of a currency with no inflation and no central bank.
The whole concept of cryptocurrencies has been criticised for its ecological impact, with "mining" for new coins requiring vast energy reserves and the associated carbon footprint of the whole system.
Richard Partington and Martin Belam
The user, “devops199”, triggered the flaw apparently by accident. When they realised what they had done, they attempted to undo the damage by deleting the code which had transferred ownership of the funds. Rather than returning the money, however, that simply locked all the funds in those multisignature wallets permanently, with no way to access them.
“This means that currently no funds can be moved out of the multi-sig wallets,” Parity says in a security advisory.
Effectively, a user accidentally stole hundreds of wallets simultaneously, and then set them on fire in a panic while trying to give them back.
“We are analysing the situation and will release an update with further details shortly,” Parity told users.
Hard fork
Some are pushing for a “hard fork” of Ethereum, which would undo the damage by effectively asking 51% of the currency’s users to agree to pretend that it had never happened in the first place. That would require a change to the code that controls ethereum, and then that change to be adopted by the majority of the user base. The risk is that some of the community refuses to accept the change, resulting in a split into two parallel groups.
Such an act isn’t unheard of: another hack, two years ago, of an Ethereum app called the DAO resulted in $150m being stolen. The hard fork was successful then, but the money stolen represented a much larger portion of the entire Ethereum market than the $300m lost to Parity.
The lost $300m follows the discovery of bug in July that led to the theft of $32m in ether from just three multisignature wallets. A marathon coding and hacking effort was required to secure another $208m against theft. Patching that bug led to the flaw in Parity’s system that devops199 triggered by accident.
Parity says that it is unable to confirm the actual amount lost, but that the $300m figure is “purely speculative”. The company also disputes that the currency is “lost”, arguing that “frozen” is more accurate. But if it is frozen, it appears that no-one has the ability to unfreeze the funds.
“The Parity vulnerability was the result of an incorrectly coded smart contract used by the Parity wallet to store tokens on the Ethereum network,” said Dominic Williams, founder of blockchain firm DFINITY. “The vulnerability made it possible for anyone to ‘freeze’ the tokens held by that smart contract, making them immovable. At this time, the only method we are aware of to ‘unfreeze’ tokens held by the vulnerable smart contract would be to create a new ‘hard fork’ Ethereum client that deploys a fix. This would require every full node on the Ethereum network to upgrade by the date of the hard fork to stay in sync, including all miners, wallets, exchanges, etc.”
Ethereum has rapidly become the second most important cryptocurrency, after Bitcoin, with its price increasing more than 2,500% over the past year. One token of Ether is now worth a little over $285, up from $8 in January.
- This article’s original headline has been amended for greater clarity. The original version of this article also suggested Parity introduced a new flaw into the system; the company did not introduce the flaw into the system, but did fail to eradicate it.
- Introducing the new celebrity accessory: bitcoin-style cryptocurrencies
