Oh that is beautiful.

So if you're playing along at home: the consensus Bitcoin chain is the longest one consistent with the rules of Bitcoin Core, the lineal descendant of the Satoshi client.

This consensus chain currently includes 1+ transactions T, which effected this theft.

The proposal is for a large number of miners to abandon the consensus chain and start mining a new chain at one transaction prior to T, replaying all real transactions minus T plus a new transaction which would moot T.

With enough hashpower, this chain eventually surpasses the current longest chain and at that point all points on network, not just mining cartel, will agree that T never happened.

This is supposed to be impossible because it is incentivize-incompatible, as the mining cartel would lose an incredible amount of segniorage to make it happen and it wouldn't be a sure thing. Point #2 is mooted by mining centralization, a ship which has sailed. Point #1 could get mooted by a payment outside the standard understanding of the Bitcoin protocol.

Comedy gold!

Someone further down the thread also mentioned a very good point in that the attackers could potentially start a bidding war against such a fork. They would have nothing to lose compared to a situation where the heist is reversed.

They have a fairly elegant mechanism to do so, too: just chain transactions from T to the addresses the miners send their coinbase transactions to. If miners go forward with the re-write history plan, the bribe gets undelivered, Back to the Future style.

It might be one of the first cases of bribery where the briber doesn't have to talk to the bribee to discuss the object of the conspiracy, the price, or how the bribe would be delivered.

Schelling-point bribery

Kinda reminds me of Eliezer's concept of acausal blackmail

Amazing.

Oh it gets better! The attackers can do things like entangle their stolen Bitcoin in systemically important institutions. Say, send 0.01 BTC to Coinbase. Coinbase is probably not operationally capable of separation that Bad Bitcoin from their Good Bitcoin before it's been comingled with customer funds. At that point, reversing T would also invalidate consequential transactions by Coinbase, which is probably something they can't allow to happen, so they would pay miners to not reverse.

Comedy. Gold!

It sounds like miners could find a replacement revenue stream even if block rewards go to zero and transaction fees are low: Hold the blockchain hostage for reversal and sell out to the highest bidder!

(Of course, this would likely drive the value of 1 BTC to exactly $0)

(Edit: This is all a demonstration of how the security of the blockchain absolutely depends on mining hashpower being widely decentralized and distributed)

Which is one of the more practical reasons a rollback is very, very unlikely to happen. (It would have been fairly unlikely even in the case of ethereum/theDAO, had not the nature of that exploit effectively locked the funds for a month.)

What happens to people/exchanges that had already accepted stolen cryptocoin after such "justice forks"?

In that new valid blockchain, the transaction where they were given that coin will simply not be there.

I'm not 100% sure but I think that anyone can re-submit the "undone" transaction to the new blockchain, as long as the source address hasn't already spent its balance on the new chain? Isn't this what's called a "replay"?

Comedy gold indeed.

> This is supposed to be impossible because it is incentivize-incompatible

Enter the wonderful world of coco values and side payments in game theory. Incentive compatibility and strategyproofness arguments break down when parties are compensated (implicitly or explicitly) out-of-band. That's not always a bad thing - it can lead to more efficient, utility maximizing equilibria. That said, under the status quo, we're trading one flavor of centralization (monetary policy) for another (core committers and mining pools).

Not to mention repeated game effects (of setting a precedent in this case), which make the setting even more difficult to analyze.

And yet, despite all of this and more, the chaotic Bitcoin apparatus lumbers doggedly forward, with little sign of stopping. Should be interesting to see where it ends up.

This has been proposed for every large hack in the history of Bitcoin. Not sure if it was by core devs every time, but the proposal always comes out.

It has never happened. This time will not be different.

Interesting history: Luke-jr (core dev) blacklisted some addresses in a package install of bitcoin he maintained, but this sort of censorship was never in the mainline source.

Source: joined Bitcoin community in early 2011, been enjoying bottomless popcorn ever since :-)

Luke banned on chain gambling due to spam but he was destroyed for it

You seem to have linked to the wrong comment; I'm guessing the comment you meant to link to was https://www.reddit.com/r/Bitcoin/comments/4vupa6/p2shinfo_sh...

This talk about bribing miners to re-org the blockchain should be a huge wake-up-call to anyone trusting the nature of bitcoin. Incredibly interesting to watch from the sideline.

I'm sure with a little research, you're going to find even more random talks. Doubt anything will be done, it was a site that got hacked, they'll have to pay anything possible and get bankrupt.

It's not like they're actually going to do it. It would be very unwise financially.

Not quite. No transaction blacklisting. He's proposing paying miners to re-mine the blocks without those transactions. In other words, compensate them for the hashing power required to make a new fork.

Very different from the ethereum situation. Miners won't go for it though. Would cost them too much from confidence loss.

Because it worked so well for Etherium...

I don't see a problem with (a lot) individual miners makings such choices. Not quite the same as concerted forking to reverse a bug in proprietary system that you don't like that others see as a feature.

Do you know what happened in Ethereum? The block chain split and now both chains are running independently. You can buy New Ether or Ether Classic. If this happens a lot it will be crazy and confusing.

It will be confusing to people thinking in a 20th century way, where everything must have one reality.

The future is all about multiple versions of reality maintained simultaneously. There's no reason there has to be a single monetary system with agreement. Small groups of people with different values can have a totally different view of who has how much money.

You're right it's confusing, that's why this hasn't started happening until the software age. Now that we have software, we don't have to understand the books, we just have to be able to write software that can make sense of them.

There will always be a "main Ethereum" for people who need a single-source-of-truth and don't want to deal with multiple realities. But the point of anarchist software is that everyone doesn't have to agree. Everyone can just do their own thing, and elect to share realities when they want to.

This idea that there is one Bitcoin Network and one Ethereum Network is the biggest misconception people have about federated technologies. People imagine consensus means "one truth". But consensus means many truths, each which only have consensus within themselves. There's always been many Bitcoins. We just ignore most of them, by choice. We're so used to someone forcing us at gunpoint to agree to a single universal legal reality that we have a hard time imagining a world where there are lots of different sets of conflicting rules, and individuals choose which ones to pay attention to.

There really are two issues here:

1) in actual fact, very few votes were cast for ETH. Although many people ran the clients that supported a fork, most of them simply did so because it was the only option for their chosen client - there was no non-fork client option easily available to them. Very few people explicitly chose the clients to support the fork.

2) "Will of the people" defeats the point of ETHs smart contracts. If everyone in the pool decided to buy in on a bet of a digital coin toss, and the bet ends up 51% heads and 49% tails, is it ok for the heads bettors to simply consensus the bet out of the chain and reclaim their money in the event that tails wins?

Blockchains require the will of the people. You can't force people to acknowledge numbers just because they're written down somewhere unless you point a gun at them. If the people you want to interact with start looking at a different source of truth, you can't stop them.

Despite this fundamental truth, blockchains are extremely useful.

I can accept this, but it means that smart contracts can't be trusted. Ethereum can't have it both ways, despite saying they can.

That's reasonable enough. I think when there are contracts people actually want to use, no one will be turned away by the small chance that the entire ecosystem will maliciously alter that contract.

All the major clients included a non-fork option. The decision was ultimately made by the miners, who certainly have the technical competence to set options at the terminal.

Isn't Bitcoin mining quite centralized, with a few chinese operators controlling a large majority?

It only works because the other party (Bitfinex exchange) is centralized and therefore can be held accountable to pay the miners. Reorganizing the blockchain is not possible (aka economically incentivized) in almost all other circumstances. Read his followup for more info: https://www.reddit.com/r/Bitcoin/comments/4vupa6/p2shinfo_sh...

Not going to happen.