Privacy-Centric Cryptocurrency Firo Suffers 51% Attack on Its Network

The proof-of-work (PoW) cryptocurrency Firo announced that its protocol came under a 51% attack, notifying its holders to stop transactions. Formerly known as Zcoin, the privacy coin was reportedly subject of a blockchain reorganization attack.

Firo Team Clarified the Attack Cannot Be Attributed to a ‘Coding Error’

According to a series of tweets published by Firo, the attacker breached the protocol on January 19, and they are working to restore operations. However, the Firo team clarified that the 51% mining attack is not the result of “a coding error but [the] nature of PoW.”

One of the first reports about the attack came from the Binance CEO, Changpeng Zhao, who said:

XZC (FIRO) 51% attack, 306 blocks rolled back, to 2021-01-18 17:24:20(UTC). Another messy situation.

At the time of making the attack public, Firo posted a tweet that said:

We are working with exchanges and pools currently. Chainlocks that would have prevented this were being tested on testnet and was weeks away from deployment.

The Firo team’s Telegram group has been posting some updates about the incident. Some of the posts revealed that the attacker “orphaned” confirmed transactions from January 18.

As a preventive measure to deal with the incident, Firo released a hotfix wallet on January 21, asking people to upgrade their wallets and masternodes. As of press time, the team said the attack has stopped.

According to markets.Bitcoin.com data, Zcoin (XZC) is quoting at $4.2568, down -16.51% on January 21. However, it remains positive on a yearly basis.

Recent Incidents Related to Proof-of-Work Cryptos

The most recent attack on a proof-of-work cryptocurrency dates back to November 2020. Grin, another privacy coin that suffered a 51% attack on its blockchain network. The Grin team built its token on the Mimblewimble protocol.

On February 17, 2020, Zcoin (now Firo) reported that a typo had let an attacker cash a profit of around $400,000 at that time. They explained how the incident happened:

A typographical error on a single additional character in code allowed an attacker to create Zerocoin spend transactions without a corresponding mint.