It's very much 'by design' in the currency... Anyone who accepts an incoming transaction should wait the necessary amount of blocks to verify that transaction, and for large amounts of $$$'s, one should wait longer. The waiting time should be at least the cost of 51% of the hashpower for the value of the transaction.

Clearly some exchanges weren't following that rule!

This doesnt make sense to me -- as I understand it, controlling 51% of the hashing power means you can eventually undo any transaction in the system, because you can start from any point, and mine from there. As long as you continue to hold 51%+, you'll eventually have the longest chain, and thus the official history. That is, there is no protection from a 51% attack, except time and difficulty to continue the attack until success.

Waiting for a certain number of blocks is only to reduce the probability of natural fork eliminating the transaction (by eventually outgrowing the fork you included your transaction into) to infetesimally small.

4000 blocks is also, I think, extremely deep into the chain. As I recall, bitcoin exchanges default to like 6 blocks before confirming?

At least, this was from my readings into bitcoin -- not sure if ethereum changes that equation, but im fairly positive it doesnt.

Hashpower is rented these days. So the question becomes 'how much hashpower you need for how many days'. Which has a dollar value.

If you are verifying a transaction of a given value, you would be stupid not to wait the dollar value of the hashpower required to reverse the transaction. If you run a service and someone could sign up for multiple accounts, you should take that into account too...

Unless someone actually buys a facility (or facilities)with express purpose of making a monopoly, and does not rent it for cheap to others.

Detecting the attack or vulnerability to it is easy in smooth difficulty increasing proof of work systems by looking for spikes in difficulty... But waiting for too long is not acceptable.

> 4000 blocks is also, I think, extremely deep into the chain. As I recall, bitcoin exchanges default to like 6 blocks before confirming?

This attack was against Ethereum Classic, which has a block time of 13 seconds. 4000 blocks ≈ 14 hours.