<story><title>A successful Bitcoin double spend – USD 10000</title><url>https://bitcointalk.org/index.php?topic=152348</url></story><parent_chain><item><author>nostromo</author><text>I&apos;ve actually thought about putting some play money in Bitcoin, but these stories prevent me from doing so.&lt;p&gt;This guy is (apparently?) unhappy, and he&apos;s knowledgable enough about bitcoin to know to inspect forks and vins and OKPAY transactions -- and then to make two double (?) spend transactions.&lt;p&gt;If this guy is getting screwed, I&apos;d surely manage to lose twice my investment somehow.</text></item></parent_chain><comment><author>ramanujan</author><text>It looks like this possibility was known and broadcasted to merchants during the maintenance window two days ago. It&apos;s kind of like the Rails mass assignment or security bug: merchants are just going to have to stay on top of Bitcoin issues.&lt;p&gt;&lt;a href=&quot;http://www.reddit.com/r/Bitcoin/comments/1a51xx/now_that_its_over_the_blockchain_fork_explained&quot; rel=&quot;nofollow&quot;&gt;http://www.reddit.com/r/Bitcoin/comments/1a51xx/now_that_its...&lt;/a&gt;&lt;p&gt;&lt;pre&gt;&lt;code&gt;  [Submitted March 12]

  It&apos;s DanielTaylor again and I wanted to create a simple yet 
  intuitive post to explain the folks out there what happened  
  a couple of hours ago. This might also be useful for 
  bloggers or journalists who might be going to write about 
  it in the following hours.

  TL;DR

  The programs that read the blockchain, the bitcoin ledger, 
  disagree.

  Due to a bug in 0.7, it says that HIS is the correct 
  version of this ledger and 0.8 says that HIS is the correct 
  version.

  Miners (the people who add pages to the blockchain) are 
  told to switch to the 0.7 program so that this version 
  gains more support and the other one is discarded. 
  (orphaned).

  Regular users are not affected. Their transactions are 
  included in both ledgers and don&apos;t need to change any 
  programs.

  During that time, though, there is a slight chance of a 
  double-spend ocurring. That is why people recommended 
  merchants and exchanges to wait until there is one single 
  blockchain again before processing purchases and 
  merchandise.

  ...

  What&apos;s a double-spend?

  This is the reason why some merchants and exchanges stopped   
  processing incoming bitcoins for a couple of hours.

  The bitcoin network prevents people from spending the same 
  coins by mantaining this unique ledger, the blockchain. But 
  now that there were two of them, it was theoretically 
  possible to broadcast two different transactions with the 
  same coins and still get some confirmations.

  With some luck, someone could sneakily sneakily* buy a 
  television to a merchant who was reading the 0.8 ledger and 
  have the transaction confirmed. At the same time he could 
  have sent the same coins back to himself and, with some 
  luck, have the transaction confirmed on the 0.7 ledger.

  What happens is that, in the end when 0.7 wins, the thief 
  will have the television and his bitcoins. Remember that 
  there were two different versions of the same coins!

  This is not something easy to do and requires a lot of luck 
  because the blocks mined (the pages added to the ledger)  
  must be mined precisely in the correct order. But still, in 
  this situation it was easier to pull off and so it was 
  recommended for merchants and exchanges to temporarily stop 
  processing incoming transactions.

  Now the situation has resolved and the blockchain keeps 
  growing happily, page by page, block y block.&lt;/code&gt;&lt;/pre&gt;</text></comment>
<story><title>A successful Bitcoin double spend – USD 10000</title><url>https://bitcointalk.org/index.php?topic=152348</url></story><parent_chain><item><author>nostromo</author><text>I&apos;ve actually thought about putting some play money in Bitcoin, but these stories prevent me from doing so.&lt;p&gt;This guy is (apparently?) unhappy, and he&apos;s knowledgable enough about bitcoin to know to inspect forks and vins and OKPAY transactions -- and then to make two double (?) spend transactions.&lt;p&gt;If this guy is getting screwed, I&apos;d surely manage to lose twice my investment somehow.</text></item></parent_chain><comment><author>jimrandomh</author><text>This guy wasn&apos;t the one screwed, OKPay (a payment processor) was; he took advantage of a several-hour window during the blockchain fork that happened a few days ago, to send them coins, wait until they gave him money for those coins, then take the coins back. This sort of thing is a risk for those operating exchanges and payment processors, not for end users. He returned the coins later - he had to, since he used an account linked to his real name - but a more-anonymous version of the same scenario is theoretically possible.&lt;p&gt;(On the other hand, there have been a few high-profile instances of end-users getting their coins stolen - usually by keeping them in an unencrypted wallet on a computer that gets a virus, but also in more exotic ways, like depositing them in an &quot;online wallet service&quot; run anonymously and registered to the Cayman islands.)</text></comment>