Source-linked AI summary
Bitcoin Transaction Malleability and MtGox
Christian Decker, Roger Wattenhofer
TL;DR
Transaction malleability could let attackers modify and rebroadcast valid Bitcoin transactions, threatening systems that identify withdrawals solely by transaction hash, a concern highlighted by MtGox’s collapse. The paper analyzes network traces and transaction conflicts to assess exploitation and finds that attacks before MtGox halted withdrawals were too limited to explain its claimed losses.
Problem
MtGox claimed transaction malleability caused withdrawals to appear failed and led to over 500 million USD in customer losses, raising whether the weakness was exploited and plausibly brought down the exchange.
Method
The paper analyzes Bitcoin network traces, blockchain-confirmation outcomes, conflict sets, and transaction values to measure malleability attacks and assess the MtGox incident.
Results
Only 1,811 bitcoins were involved in attacks before MtGox stopped withdrawals, and barely 386 bitcoins could have been stolen using malleability attacks.
Takeaways & Limitations
Transaction malleability is real and should be considered when implementing Bitcoin clients, but observed attacks did not substantially influence MtGox’s losses.
Takeaways & Limitations
Network traces cannot reveal whether an issuing system relied solely on the original transaction hash, a condition required for exploitability.
Abstract
from arXiv · showhide
In Bitcoin, transaction malleability describes the fact that the signatures that prove the ownership of bitcoins being transferred in a transaction do not provide any integrity guarantee for the signatures themselves. This allows an attacker to mount a malleability attack in which it intercepts, modifies, and rebroadcasts a transaction, causing the transaction issuer to believe that the original transaction was not confirmed. In February 2014 MtGox, once the largest Bitcoin exchange, closed and filed for bankruptcy claiming that attackers used malleability attacks to drain its accounts. In this work we use traces of the Bitcoin network for over a year preceding the filing to show that, while the problem is real, there was no widespread use of malleability attacks before the closure of MtGox.
1 Introduction
Bitcoin exchanges broadened adoption and price discovery but introduced centralized points of failure. MtGox’s bankruptcy followed customer losses attributed to transaction malleability, motivating this study’s investigation of exploitation and plausibility.
- Bitcoin exchanges enabled broader public access, price discovery, and increased attention to Bitcoin’s value.
- Centralized exchanges created potential failure points in an otherwise decentralized system, alongside risks from thefts and volatile trading.
- MtGox accounted for close to 70% of bitcoins ever traded in February 2014 before filing for bankruptcy after losses exceeding 500 million USD.
- MtGox claimed transaction malleability let users make withdrawals appear failed, prompting the exchange to restore balances after transactions later confirmed.
- The paper asks whether transaction malleability was exploited and whether such exploitation plausibly brought down MtGox.
2 Transaction Malleability
Bitcoin transactions use scripts and signatures to authorize transfers, but the signature does not protect the scriptSig’s encoding. Attackers can therefore alter a transaction’s hash without invalidating its signature, potentially exploiting systems that track confirmations by hash.
- Bitcoin transactions reassign bitcoins from inputs to ordered outputs, and transaction identity is the SHA256 hash of serialized transaction data.
- Bitcoin’s non-Turing-complete scripting language uses stack-based, single-byte opcodes and multiple operations for pushing data.
- Standard transactions require a claiming script to provide a public key matching the address and a valid transaction signature.
- Because scriptSig integrity is not covered by the signature, equivalent script encodings can produce different transaction hashes while remaining valid.
- A malleability attack intercepts a victim’s transaction, modifies its signature representation, and rebroadcasts a transaction with a different identification hash.
- The attack becomes exploitable only when the modified transaction confirms and the issuing system tracks confirmation solely through the original hash.
- Bitcoin Core is not susceptible because it tracks the confirmed unspent transaction output set rather than only transactions it issued.
3 MtGox Incident Timeline
MtGox first halted bitcoin withdrawals after months of non-confirming transactions, then publicly attributed the problem to transaction malleability. The exchange subsequently stopped operating and filed for bankruptcy.
- MtGox’s incident timeline was reconstructed from its press releases, official filings, and post-closure legal documents.
- After several months of withdrawal problems, MtGox suspended bitcoin withdrawals on February 7 while trading remained possible.
- Users could not access deposited bitcoins during the withdrawal halt, while fiat withdrawals remained possible but slow and sometimes failed.
- On February 10, MtGox identified transaction malleability as the sole cause of non-confirming withdrawal transactions.
- MtGox described a software bug that could make completed transfers appear unsuccessful, allowing bitcoins to be resent.
- The described mechanism involved modified withdrawals racing original transactions, potentially causing users to receive bitcoins through both the withdrawal and a restored account balance.
- After further announcements, MtGox’s website disappeared on February 23, and the exchange announced bankruptcy on February 28.
4 Measurements
The measurements identify malleability attacks from Bitcoin network traces, quantify their success and prevalence, and compare activity before and after MtGox’s press releases. Before the releases, attacks were limited and did not substantially influence MtGox’s losses, while later activity surged and appears to have involved imitators.
- Attack detection: 35,202 conflict sets were identified as evidence of malleability attacks; 29,139 contained a transaction later confirmed in a block.The remaining 6,063 were invalid, had incorrect signatures, or belonged to further double spending.
- Attack classification: 28,595 of 29,139 confirmed attacks used OP_PUSHDATA2 instead of the default OP_0, while 544 conflict sets had unidentifiable originals.The 544 remaining sets had genuine signatures with correct opcodes but were believed to result from users signing raw transactions multiple times.
- Attack success: 19.46% of 28,595 OP_PUSHDATA2 attacks were successful, with a comparable value-weighted success rate of 21.36%, reducing total profit from 302,700 to 64,564 bitcoins.A successful attack is one in which the modified transaction was later confirmed in a block.
- MtGox incident: 421 conflict sets involving 1,811.58 bitcoins occurred during period 1 before the press release, and the authors conclude these attacks did not substantially influence MtGox’s losses.Attacks in periods 2 and 3 occurred after withdrawals had stopped and therefore could not contribute to the declared losses.
- MtGox incident: Between February 10 and 11, period 3 contained 25,752 attacks totaling 286,076 bitcoins, two orders of magnitude above period 1, with a later smaller wave of 9,193 bitcoins.The strong correlation with the press releases indicates that the attacks were triggered by them; assuming MtGox had disabled withdrawals, they could not have targeted MtGox.
5 Related Work
Prior work focused more heavily on classical double-spending, while transaction malleability received limited attention despite being known since at least 2010. This paper provides the first detailed description of malleability attacks.
- Transaction malleability: Transaction malleability was documented by 2010 but treated as a low-priority issue.
- Prior malleability work: Earlier Bitcoin contract protocols addressed malleability by excluding malleable transaction parts from hash calculations.These protocols included fair coin tosses, auctions, and decentralized voting.
- Classical doublespending: Classical double-spending attacks, in which the transaction issuer creates conflicting transactions, received substantially more attention than malleability attacks.Prior studies examined fast payments and transaction propagation.
- Contribution: This paper is presented as the first publication describing transaction malleability and the resulting malleability attack in detail.
6 Conclusion
The authors find that transaction malleability is a real implementation concern, but observed attacks cannot account for MtGox's claimed losses. Most attacks were ineffective, and only a small amount could have been stolen.
- Conclusion: 302,000 bitcoins were ever involved in malleability attacks, including 1,811 bitcoins before MtGox stopped withdrawals.78.64% of attacks were ineffective, leaving barely 386 bitcoins potentially stolen from MtGox or other businesses.
- Conclusion: Transaction malleability should be considered when implementing Bitcoin clients.