flenst posted on August 15, 2019 00:20:52
This is a cleaned copy paste of my reddit post. As of today, 8 days later, devs still ignoring the issue. Probably really not realizing it or simply knowing they are not capable of fixing it.
Edit: lead dev of Vergecurrency is commenting and showing absolute lack of understanding what is happening here. Also said "these are pools", yet there is no publicly available pool mining these blocks ¯\_(ツ)_/¯
I decided to tag Binance [here](https://www.reddit.com/r/CryptoCurrency/comments/cmmrzu/vergecurrencys_x17_mining_algorithm_is_being/ew66uv9?utm_source=share&utm_medium=web2x). Pointing the lead dev at the exploited blocks, all the [orphans](https://www.mining-dutch.nl/pools/verge_blake2s.php?page=statistics&action=blocks) it generates even on other algorithms, and still getting told "everything is fine kid!" should be noted by services that may be affected by this.
Currently ranked around CMC 70 still one of the bigger projects, and basically a prime example how inferior tech, copy paste, some teenie style hype and false promises still lead to mulitmillion dollar valued coins.
A quick look at the block explorer was enough: one entity overtook the X17 mining algorithm months ago. See here: https://miningpoolstats.stream/verge-x17
The publicly known pools do not find blocks on this algorithm anymore. What is happening?
An unknown entity mines very fast subsequent blocks up to the current limit (6 blocks in 6 seconds is maximum I observed) on three different addresses. Since these mined blocks are special it is very easy to track how many blocks are mined every day by this entity: https://verge-blockchain.info/tx/651eb493f494d786bd633d1f07625b209540419cb6ad072710dbbc526364d236
You see the 0 XVG in the mining output transaction? All lead here: https://verge-blockchain.info/address/D5rspBySU33gsw15bHZ9Re1gQFmjYUPtuz
Take a quick look on the timeframe of the possible 500tx viewable in this explorer, calculate profit in 24hour with exploiting XVG. You also see these fast subsequent blocks are a pattern, no coincidence. \~570 blocks a day, mean 416.100XVG, or at current rates \~2.300$ a day.
Here is a list of the three addresses that are used for exploiting X17:
https://verge-blockchain.info/address/DF2ZaVNoxY7G92Ke5U1LfGhgkfdZWUqjnn ( 10135842.1 XVG so far )
https://verge-blockchain.info/address/D5bWnS2rViqGyEtiPjviRgmWhocdCGxBFh ( 10137386.2 XVG so far )
https://verge-blockchain.info/address/D5kzjye6MEC9uwJ4YwhZaEEJE3BTNryGML ( 10016095.5 XVG so far )
So in total the attacker silently mined 30.289.000 XVG over 2+ months, or \~212.000$ with unknown effort.
I can just assume all algorithms are vulnerable but the attacker wants to make profit and fly under the radar.
Stay safe and don't trust shiny whitepapers, fabulous advertising or snake oil community updates. Just trust the unfiltered underlying tech. Also dive your own favorite projects chain. Blockchains are awesome! :)
Edit: a XVG official commented trying to damage control. The link explaining how time drifts on blockchains can be used to exploit a chain and how they are created is no answer to the observations you can make on their X17 algorithm. In fact the attack explanation in this link should be close to what is happening on the chain. He also missed in 2018 they "fixed" the timedrift exploit by reducing the possible shift down to 15 minutes from 2 hours.
Edit2: while the XVG official tried to deflect he brought something to my attention. In the exploiting miners blocks the median\_time of previous blocks and the timestamp perfectly fit. So these blocks are clearly manipulated. Time on regular blocks should always be higher than the median time of previous blocks, see: [https://bitcoin.stackexchange.com/questions/67618/difference-between-time-and-mediantime-in-getblock](https://bitcoin.stackexchange.com/questions/67618/difference-between-time-and-mediantime-in-getblock)
And see this manipulated block: https://verge-blockchain.info/api/getblock?hash=4f184e33bcefd755ee885c3fb7ea3b4c7e5023c942aada8c26a7fb2e6b2b25d0
Regular blocks have a difference between median and time of dozens of seconds. The exploited blocks not, maximum 1 second drift. I think this is part of the exploit itself.
Edit3: the lead dev answered https://www.reddit.com/r/CryptoCurrency/comments/cmmrzu/-/ew4atbx and shows he has absolutely no clue what is happening there.
I can also tell you, now after they tried to sell snake oil again, the [suprnova.cc](https://suprnova.cc) admin who noticed the exploits in 2018 confirmed it already ;)
Want to tip a beer?
Jason T. posted on February 12, 2019 18:39:19
Suffered multiple 51% attacks in 2018, multiple delayed roll-outs of their highly anticipated Wraith protocol, very unprofessional PR and marketing (@XVGWhale), paid Pornhub for the partnership (and no one even uses it for that purpose). Need I say more? Stay far away from Verge. You can just set up TOR yourself and use Monero or Zcash - 2 much more respected and legit privacy/anonymity focused cryptocurrencies.
Crypto Anonymous posted on October 17, 2018 06:45:04
Endlessly postponed the Wraith Protocol, which has also been very controversial if it adds even anything substantial as they hyped it. They tried to raise funds from their coin holders for a huge announcement that would only go through if they reached a certain amount: that appeared to be the Pornhub partnership. Also they suffered a 51% attack 3 times. Seems a shady, unprofessional project and far from a secure store of value. Has also been through multiple epic pump&dump cycles
Get a weekly update on the best and worst projects right in your inbox.