A doomsday scenario that has long been dismissed by bitcoin’s biggest boosters is now a clear and present danger. At 3am ET this morning, a single bitcoin mining collective known as Ghash.io reached 45% of the computing power of all global bitcoin miners, just six points short of the 51% that would be required to break bitcoin by arbitrarily manipulating the record of future transactions upon which it rests. The result could be, at minimum, “double spending” of existing bitcoins, which would render the currency effectively unusable.
To put this in context: Imagine that tomorrow, a single corporate entity gained the ability to clone all of its dollars, and then immediately went on an asset buying spree. To say that it would undermine trust in the US dollar would be an understatement. That’s what could happen to bitcoin.
Update: Ghash.io has issued a press release on the potential for it to launch an attack on bitcoin. The mining pool says it is taking steps to make sure that Ghash.io never reaches 51% of the world’s bitcoin mining capacity, “as it will do serious damage to the Bitcoin community, of which we are part of.” Ghash.io also said that they will temporarily stop accepting new independent bitcoin miners in their pool, and will allow existing members of Ghash.io to mine bitcoins through other pools.
Update 2: Bitcoin magazine has weighed in, asserting that the success of Ghash.io is indicative of a larger problem in bitcoin: nearly unprecedented centralization of the mining upon which the currency’s security depends.
Update 3: Bitcoin entrepreneur Henry Brade weighs in on Ghash.io’s proposed solution, and finds it wanting. Quartz’s Ritchie King weighs in: No, bitcoin isn’t about to be taken over by a massive cartel.
Popular discussion boards devoted to bitcoin are freaking out about this possibility, and every post on the homepage of, for example, the portion of Reddit devoted to bitcoin is currently devoted to the dangerous rise of Ghash.io:
The entreaties of bitcoin fans on Reddit is having some effect: Between 3am ET and the writing of this article at 10am ET, the power of Ghash.io has diminished by seven points, to 38%, probably because of people leaving the collective in response to the backlash. But how close it came illustrates the long-term problem.
How this attack on Bitcoin works
A little background for the uninitiated: The way bitcoin works (see our recent explainer on the topic) is that computers “mine” for the currency by solving tough math problems. In the process, they verify all the recent transactions that have been made via bitcoin. This is part of the genius of bitcoin: The only way to produce new bitcoins is to create the computing infrastructure required to make bitcoin work.
Because so many different people mine for bitcoin by running bitcoin software and solving these hard math problems, the logic of bitcoin boosters has always been that the currency is safe because the bitcoin network is distributed across so many different computers. As long as at least 50% of the network is owned by “honest” bitcoin miners whose incentive is to keep bitcoin intact, no nefarious manipulations of the record of bitcoin transactions (known as the “blockchain”) will take place.
What the maker of bitcoin apparently did not anticipate is that many bitcoin miners might band together into “pools” in which their total computing power is harnessed together as if it were one giant supercomputer. Being part of a pool means sharing the profits of that pool, which can lead to a steadier stream of income for individual miners.
The potential danger of Ghash.io
We’ve reached out to the founders of Ghash.io and await their comment. In the meantime, many commenters are pointing out that in the past, someone using nothing but Ghash.io’s pool to mine bitcoin has already attempted to spend the same bitcoins twice, at a gambling site called Bitcoin Dice. Whether this person is a rogue actor or more intimately connected with the leaders of Ghash.io, it suggests that at least someone in this mining pool has already realized that they could make a temporary profit by gaming bitcoin, even if it threatens the currency itself.
A long-term threat the bitcoin community has yet to resolve
Even if Ghash.io doesn’t reach 51% of world capacity of bitcoin computation and mining, the fact that a single pool came this close illustrates that it’s at least possible. Worse, a November 2013 paper from computer scientists at Cornell illustrated that it might be possible to hijack bitcoin with far less than 51% of the world’s mining power, or as little as 33% of the global bitcoin computational pool, which Ghash.io is already well in excess of.
Currencies are based on trust. If community trust in bitcoin is destroyed, the “dreams” on which bitcoin is based might turn out to be only as robust as the real thing.
Hat tip: Christoph Möller, who brought this story to our attention