Ethereum Classic Attack, 8 August: Catch me if you can

After attacking the Ethereum Classic chain on July 31, 2020, the same attacker hit the chain again on 6 August. The massive reorganization of 4236 blocks happened on the Ethereum Classic blockchain at 2020-08-06 02:54:27 UTC.

It affected blocks from 10935623 to 10939858. The attacker mined the first block at 2020-08-05 11:50:20 UTC, so this attack lasted 15 hours and 6 minutes.

Key Takeaway

This time the miner tried to double-spend 465,444 ETC (about $3.3M at the time). Our trace shows about 238,000 ETC ($1.68M) double-spent through Bitfinex and another crypto service. The miner also earned 14.2K ETC in block rewards, which the double-spend total leaves out.

Hash Power

The miner probably rented hash power from the same source, NiceHash's daggerhashimoto, as observed on the following graph.

NiceHash price and TH/s during the attack (UTC+3)

The mining address, 0x3936968a445b723fdd0c0407efffcaecb07cab19, mined 4236 blocks consecutively, plus some extra blocks after the reorg. The block reward from this attack was 14,234.30 ETC, which was still in that wallet at the time of writing.

The attack shows up as a single dominant miner on the miner distribution chart from the Bitquery explorer.

Double-Spent

Our analysis points to the same miner, using the scheme described in our investigation of the July 31 attack.

This time the miner included seven transfers in the mined blocks. The total amount of these transactions was 465,444 ETC (about $3.3M).

Where the money came from

The funds came from the first attack on July 31. Our earlier analysis showed the double-spend going to an exchange and to wallets the miner controlled. This time, the miner spent the coins left over from that attack.

For example, the address 0x305292887ad1ffa867e8564c804575f3d7a19a1f is the source of money for the first transaction in the list. This address was used in the first attack. Similarly, other addresses mentioned in the above transaction list also got money from the first attack.

Funds flowing from 0xc39241a847c550bbef4489653b1006b980709e4b

Where did the double-spent ETC go?

The hidden blocks included transactions that moved the funds to other wallets the miner controlled. This activity was not visible to anyone as the miner published neither the transactions nor the blocks, similar to the last attack.

On the public chain, which was later discarded in the reorg, the funds were first collected the money on the address 0x38cd54fc7b1fe7994355fce1d75c9c4bd7335a46. From there, the coins were split across several addresses.

All of these transactions took place while the hidden fork was being mined.

Money distributed to multiple addresses from 0x38cd54fc7b1fe7994355fce1d75c9c4bd7335a46

Apparently, the final target was some exchanges and other crypto services, and we can find some of them in the following image.

Funds from 0x38cd54fc7b1fe7994355fce1d75c9c4bd7335a46 reaching exchanges

The clusters on the right side of the graph are exchanges. The coins sent there were most likely sold for fiat or other coins.

These addresses received the funds and belong to exchanges or other crypto services:

1. 0x618f37d7ff7b140e604172466cd42d1ec35e0544, which we believe, belongs to Bitfinex exchange based on this post, received 143,000 ETC in several transactions. The transfers came from 0xb0580ae6f23ab23810116fe3645b0a8d02f5f106.
2. 0x9662a0648aa48592a63509c092ab05adf0a84cc9 received 95,650 ETC in multiple transactions. We were not able to identify the crypto service which owns this address. Its two largest incoming transactions were:

• 41,950 ETC in transaction
• 53,356 ETC in transaction

Total money loss

Our trace shows that Bitfinex lost 143K ETC (about $1M). The other service, which we could not identify, lost 95K ETC (about $680K). In total, the attack earned at least $1.68M.

Both services can use the transactions above to identify the account holder behind the deposits.

Wrapping up

In 2020, Bitquery traced these funds with Coinpath, its money-flow product at the time. Bitquery no longer offers the Coinpath API or Ethereum Classic data, so the trace above cannot be re-run with Bitquery today.

Note: Special thanks to Yaz Khoury for reviewing the article.

Also read

• Ethereum Classic 51% Chain Attack July 31, 2020
• Attacker Stole 807K ETC in Ethereum Classic 51% Attack
• Cryptocurrency Money Laundering Explained

First published in August 2020. Updated on 30 October 2026 by the Bitquery team, with help from AI tools: links to the Ethereum Classic explorer, which no longer serves this chain, were removed, and the Coinpath sales pitch was replaced with a note that the 2020 trace used Coinpath. The figures are unchanged from 2020.