Attacker Stole 807K ETC in Ethereum Classic 51% Attack

Our first post, Ethereum Classic 51% Chain Attack Jul 31 2020, set out what happened in the Ethereum Classic attack of 31 July to 1 August. Here we compare the transactions on both forks of the chain.

Key takeaway: The attacker double-spent 807,260 ETC ($5.6 million) and paid about 17.5 BTC ($192K at the time) for the hash power. The miner also earned 13K ETC in block rewards, which the double-spend total leaves out.

Data collection from reorged and non-reorged chain

In 2020, Bitquery collected data from the Ethereum Classic node based on Open Ethereum software. After the fork, it turned out that this software had a bug that blocked a reorg past a certain block number. So all data was preserved, including a series of blocks that were mined by other miners on Open Ethereum software after the reorg happened.

The only way to catch up with the reorged chain was to switch node software, and we chose Geth. But before doing that, we stored all the data of the non-reorged chain, in a separate database for future analysis.

Once the Geth node synced, we re-indexed the data from block 10904146, where the reorg started.

That gave us two datasets, which Bitquery served in its explorer and GraphQL API at the time:

1. Non-reorged chain, from Open Ethereum node (the chain every other miner worked on)
2. Reorged chain, from a Geth node (the chain the attacker built)

The two datasets match up to block 10904146 and differ from the next block on. For example, compare the next block, 10904147:

10904147 for non-reorged chain

10904147 for reorged chain

The two versions of the block differ in four ways:

1. Height is the same, but hashes are different, as these blocks have different content.
2. The parent hashes are the same, because both point to block 10904146, where the fork started.
3. The miners differ. On the reorged chain the miner is 0x75d1e5477f1fdaad6e0e3d433ab69b08c482f14e, which mined more than 3,500 blocks in 12 hours to force the reorg. On the non-reorged chain the miners are ordinary pools that kept working with no idea of the attack.
4. Transactions, transfers, smart contract calls and events also differ between the two chains.

Mining activity

The attacker replaced blocks 10904147 to 10907761. After block 10907761 the same address mined a few more blocks, but they caused no major reorg:

Activity of 0x75d1e5477f1fdaad6e0e3d433ab69b08c482f14e by date

In total, the address mined 4,280 blocks over four days. It mined very little before the attack and stopped right after, which is not how a regular miner behaves.

The miner sent all the block rewards (13K ETC) to 0x401810b54720faad2394fbe817dcdeae014066a1, where they still sat at the time of writing:

Block reward transfers to 0x401810b54720faad2394fbe817dcdeae014066a1

Attack Timeline

Our trace shows these steps:

1. July 29 to 31: 807K ETC is withdrawn from a crypto exchange to several wallets.
2. Jul 31, 16:36 UTC: the attacker starts mining with hash power rented at double the usual price on NiceHash's daggerhashimoto market, as our first post found. The hash power costs about 17.5 BTC ($192,000).
3. Jul 31, 17:00 to 17:40 UTC: the attacker creates private transactions that send the funds to wallets they control and puts them into the hidden blocks. Nobody sees them, because the blocks are not published.
4. Jul 31, 18:00 to Aug 1, 02:50 UTC: on the public chain, the attacker sends the same funds back to the exchange through intermediary wallets. Once the exchange credits these deposits, the attacker has hours to sell that balance for dollars or BTC and withdraw it. The 12-hour window lets the attacker split the work into small pieces that draw no attention.
5. Aug 1, 04:53 UTC: the attacker publishes the hidden blocks, which carry the step 3 transactions, and the chain reorganizes. The step 3 transactions replace the step 4 transactions.

The sections below walk through how the miner got away with about 807K ETC ($5.6 million).

Transactions in the hidden blocks (reorged chain)

The miner put just 11 transactions into the hidden blocks. That small number probably fed the early guess that the miner had simply lost its internet connection. These transactions never reached the shared memory pool (mempool), so no other miner could include them.

Take a look at these transactions:

The first five carry large amounts. Here they are one by one.

First transaction: 353,005 ETC

First hidden transaction, 353K ETC

Second transaction: 77,955 ETC

Second hidden transaction, 77.955K ETC

Third transaction: 194,100 ETC

Third hidden transaction, 194.1K ETC

Fourth transaction: 97,710 ETC

Fourth hidden transaction, 97.71K ETC

Fifth transaction: 84,490 ETC

Fifth hidden transaction, 84.49K ETC

The five share a pattern:

1. Each moves tens of thousands of ETC or more.
2. Each traces back to funds from the address 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f
3. All five fall in a 40-minute window from 17:00 UTC on 31 July, soon after the hidden mining began.

Wallets loaded before the attack

A double-spend needs funds in wallets the attacker controls. Five addresses were loaded before the attack:

1. 0x439ff9e3a81a4847d0c2041c06e5a272883f69f2, received 353K ETC from 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f in 22 transactions on 29–30 July 2020
2. 0x9ac1785943ead4dafb2198003786b4b29143f081, received 78K ETC from 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f in 7 transactions on 30–31 July 2020
3. 0xad599aa123c2b5b00773b9bfadacf8c3e97ea72d, received 194K ETC from 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f in 16 transactions on 30–31 July 2020
4. 0xda88ea478545581eafffa3598fd11fc38f13c508, received 97.7K ETC from 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f in 7 transactions on 30–31 July 2020
5. 0x305292887ad1ffa867e8564c804575f3d7a19a1f, received 84K ETC from 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f in 5 transactions on 30–31 July 2020

Before the attack, these addresses held about 807K ETC ($5.6 million).

Transactions on the non-reorged chain

Nobody knew the attack had started, because no hidden blocks had been published. Meanwhile, the same wallets sent public transactions, which our non-reorged dataset recorded.

This graph expands the five addresses. It shows funds withdrawn from the exchange to the attacker's wallets and then sent back to the exchange.

Transfers between the exchange and the five wallets on the non-reorged chain

Putting the two datasets side by side shows that on the non-reorged chain, the funds went back to the exchange:

• Before the attack, funds were withdrawn from 0x63a8 to the five addresses. We believe 0x63a8 is an exchange wallet.
• During the attack, the funds went back to 0x63a8 through one to three intermediary addresses.
• All the withdrawn funds returned to 0x63a8, and the exchange credited the deposits, since nobody knew of the attack.

The transactions below show funds going back to the exchange in small amounts:

Transfers back to the exchange on the non-reorged chain

These transfers were public and stood for about 12 hours while the hidden blocks were being mined.

When the reorg erased them, the attacker kept 807K ETC plus 13K ETC in block rewards, about $5,650,820 in total, for a mining bill of about $192K.

Where the double-spent ETC went

Next, the coins had to be cashed out. The trail shows a familiar pattern: amounts split across many addresses and moved through several hops.

Funds moving out of 0x1e3a5208db53be56b6340f732ec526b4bdc37981

In 2020, Bitquery traced the double-spent coins with Coinpath, its money-flow product at the time. Bitquery no longer offers the Coinpath API or Ethereum Classic data. This was the distribution at the time of writing:

Coinpath report from August 2020, starting at 0x1e3a5208db53be56b6340f732ec526b4bdc37981

Identifying the exchange

We could not confirm the owner of 0x63a8ab05ae4a3bed92580e05e7dce3b268b54a7f from on-chain data alone. Its high volume and other patterns point to a crypto exchange.

Our best guess was OKEx or an affiliate: the same address on Ethereum mainnet traded heavily with OKEx wallets.

On Ethereum, the address sent funds only to other OKEx wallets

Victor Fang, CEO of the blockchain intelligence firm AnChain.AI, confirmed that this address belongs to the OKEx exchange.

Note: Special thanks to Victor Fang (AnChain.AI) and Yaz Khoury for their help with the article.

Also read

• Ethereum Classic Attack, 8 August: Catch me if you can
• How Upbit hackers laundered millions using crypto exchanges?
• Cryptocurrency Money Laundering Explained

First published in August 2020. Updated on 30 October 2026 by the Bitquery team, with help from AI tools: links to the Ethereum Classic explorer, which no longer serves this chain, were removed, the Coinpath sales pitch was replaced with a note that the 2020 trace used Coinpath, two transaction amounts in captions were corrected (97.71K and 84.49K ETC), and the text was edited for clarity. The figures are unchanged from 2020.