Cryptocurrency exchange OKEx published a new report last Saturday, detailing how the perpetrator of the recent 51% attack on Ethereum Classic (ETC) managed to steal $5.6 million in cryptocurrency using its platform.

As we have already indicated on Arab bitcoin site The Ethereum Classic network was subjected to two 51% attacks, the first on August 1 and the second on August 6, in which the hacker gained control of 51% of the hash power of the Ethereum network and stole about $5.6 million in cryptocurrency.

Here’s how to do it:

Preparing for the attack:

According to OKEx, the hacker has been preparing for the attack since June 26, creating five fake accounts on the OKEx platform.

Read:The DOT cryptocurrency defies the market trend and is up 15%…Here are the reasons why

Notably, all of these accounts have passed the second and third KYC levels and have increased their withdrawal limits.

As of July 30, these accounts deposited a total of about 68,230 ZEC coins to OKEx.

At the same time, the hacker was building a “shadow chain” of the Ethereum blockchain (the shadow chain of the blockchain and the alternate history of transactions being hidden from the other two miners).

On July 31, the hacker’s accounts traded all ZEC coins for ETC, receiving a total of 80,7260 ETC worth about $5.6 million at the time.

Then it was transferred to the hacker’s external addresses.

The beginning of the attack:

Later that day, the hacker launched a 51% attack on Ethereum, starting his own Shadow Chain.

At this point, the legitimate and malicious transaction logs contained 807260 ETC transferred from OKEx to the hacker’s external addresses.

During the attack, the hacker sent all the previously received Ethereum to OKEx and traded them for about 78,900 ZEC, which he immediately withdrew.

Since more than 51% of the hash power of the Ethereum Classic blockchain was under the control of the hacker at this point, he was able to extract new blocks faster than other nodes, which made the shadow network faster than the original network.

Read:China reveals its new assessment of blockchain networks amid the Corona crisis

Combined with ineffective communication between exchanges, wallets, and miners, this confused the ETC community and prompted the nodes to start mining in the malicious shadow chain.

The hacker also tampered with his copy of the transaction log which is now the main version.

It was recorded that he did not send 807260 ETC to the OKEx platform, which made him get it twice, and cause OKEx to lose its money.

OKEx has blacklisted the addresses allegedly used by the hacker and suspended his five accounts.

In the future, the platform also plans to increase confirmation times for ETC deposits and withdrawals.

If the network does not become more secure, OKEx may delete ETC completely.

Read also:

Ethereum Classic is threatened with a 51% attack… for these reasons

What is the difference between Ethereum and Ethereum Classic (ETH – ETC)?