← Case fileThe bug that created 184 billion bitcoin1 / 17
Turn your phone to see the sheet larger.
01
The story
Seven hours in August 2010
1
The block
Block 74,638 carries a transaction that creates 184 billion bitcoin. Only 21 million can ever exist.
2
The warning
A user of the Bitcoin Talk forum reads the block and posts that the number is “quite strange”.
3
The fix
Satoshi adds a cap to the software. From the new version on, a transaction cannot create more than 21 million bitcoin.
4
The new chain
Nodes with the rule reject the block and mine again from the one before it.
The transaction is no longer on the chain.
02
Before we start
Six words for this case
Output
A new coin created by a transaction. What goes out cannot be more than what goes in.
Fee
What goes in minus what goes out. The miner who puts the transaction in a block keeps it.
Satoshi
One hundred millionth of a bitcoin. The software stores amounts in satoshis, as whole numbers.
Overflow
A number stored in a fixed space has a maximum. If a sum goes past it, it wraps around and shows up negative.
Branch
If two blocks point to the same previous block, the chain splits in two. The network keeps one and drops the other.
Consensus rule
What every node checks in every block. If a block breaks it, that node rejects it.
A node is a computer that runs the Bitcoin software and keeps its own copy of the chain.
03
Aug 15, 2010, 17:05 UTC · Block 74,638
From 0.5 BTC to 184 billion
4,392times the 21 million that can exist, in each output
2transactions in the block, the miner’s and this one
50.51BTC for the miner: the block’s 50 and 0.51 in fees
0.01BTC too much in that fee. The input was 0.5
TXID 1d5e512a9723cbef373b970eb52f1e9598ad67e7408077a82fdac194b65333c9. The amounts as they were posted on the forum that afternoon.
04
The software’s mistake
The sum wraps around
Each output passes on its ownThe software checked that no output was negative. Both were positive.
The sum does not fitTogether they add up to 18,446,744,073,708,551,616 satoshis. The software added them in a space that goes up to 9,223,372,036,854,775,807.
It ends up at −0.01 BTCPast the maximum, the number wraps around and shows up negative, like an odometer going from 99999 to 00000.
The rule lets it throughWhat goes out (−0.01) is not more than what goes in (0.5). The fee comes to 0.5 − (−0.01) = 0.51.
EACH OUTPUT
2⁶³ − 500,000 sats
BOTH TOGETHER
2⁶⁴ − 1,000,000 sats
WHAT THE SOFTWARE SAW
−1,000,000 sats
That someone chose those amounts on purpose is not recorded on the chain. It is deduced from the shape, because the sum comes out just barely negative.
05
Aug 15, 2010 · Bitcoin Talk forum
An hour later, on the forum
18:08 UTC · JGARZIK, “STRANGE BLOCK 74638”
“The "value out" in this block #74638 is quite strange […] 92233720368.54277039 BTC?”
He posts the whole block, as text, an hour after the time the miner put on it.
18:55 UTC · LFM, IN THE SAME THREAD
“The sum of the two outputs overflows to a negative. Its a bug in the transaction checks which did not reject it […]”
And asks people to shut down what they can and not to send or accept payments.
jgarzik copied the block from his node. theymos showed it from his own, 20 minutes later.
06
What is gone
How to check an erased transaction
It cannot be looked up todayOn today’s chain, the transaction and its block do not exist. Search for it on mempool.space and it answers that it cannot find it.
The forum kept all of itjgarzik posted the signature, the key, the coin it spends and the two outputs.
It is rebuilt, byte by byteWith that data, its fingerprint (the TXID) comes out exactly1d5e512a…65333c9. A single different byte would change the whole fingerprint.
The key owns the coinThe signing key is the one for the 0.5 BTC coin it spends, which is still on the chain.
What it proves
That the forum dump is faithful. The exact amount of each output and the two addresses come from it.
NOT CHECKED
The signature itself. The 2010 nodes accepted it, and today’s chain no longer keeps it.
The 2010 software printed the script data with its bytes reversed. Turned around, the fingerprint matches.
07
Aug 15, 2010, 21:35 UTC · the code
A new rule in four and a half hours
MAX_MONEY = 21000000 * COIN;
foreach (txout in vout) {
if (txout.nValue < 0) error("negative");
if (txout.nValue > MAX_MONEY)
error("txout.nValue too high");
nValueOut += txout.nValue;
if (nValueOut > MAX_MONEY)
error("txout total too high");
}
In green, what is new, summarized. No output, and no sum of outputs, can go past 21 million bitcoin.
UTC
What happened
17:05
The block with the overflow
18:08
The warning on the forum
20:39
Gavin Andresen posts a first patch
21:06
Satoshi asks people to stop mining: “We will probably need to re-do a branch”
21:35
The fix goes into the code (SVN 132)
23:48
Satoshi announces version 0.3.10
Commit d4c6b90 in the Bitcoin repository: “fix for block 74638 overflow output transaction”. The times come from the forum and the repository.
08
On today’s chain
6 h 51 min with no blocks
23:53the time of today’s 74,638. Block 74,637’s is 17:02
35.6 minthe next-longest gap among the 90 blocks around it
5 min 37 sbetween the 0.3.10 announcement and the first block of the good branch
8 h 26 minto mine the 54 blocks up to 74,691
The bad branch is not on the chain. How many blocks it had, or at which block the good one caught up, comes from the Bitcoin Wiki. The times are the ones each miner wrote.
09
How it looks
Satsumap says it does not exist
What is searched forThe TXID of the overflow transaction, typed into the search box.
What it answersThat it does not exist. The answer comes from mempool.space, which keeps today’s chain.
The transaction existed for a few hours on the bad branch. The chain that nodes keep today does not have it.
10
Aug 14, 2010, 23:05 UTC · Block 74,421
The attack’s coin is still unspent
Top right, the 0.5 BTCThe coin the overflow transaction spent, at 17TASsYP…FwVZSW. Satsumap marks it UTXO: unspent.
Why it is still unspentIts spending was in the erased block. Since 2010 nobody has moved it again.
1
transaction in that address’s history, the one that gave it the coin.
TXID 237fe8348fc77ace11049931058abb034c99698c7fe99b1cc022b1365a705d39, output 0. The other output, 235 BTC, was spent 17 minutes later.
11
Following the change
183 payments of 0.5 BTC
183payments up to the one to 1542Dgx5…, each with the previous one’s change
173different addresses receive the 0.5
19payments together in block 74,642, the first with payments from this chain after the gap
235 → 143.5BTC of change over those 183 steps, 0.5 less at each step
173 ADDRESSES ARE PROBABLY NOT 173 PEOPLE
In the same block 74,642, transaction fb9c3667… gathers six coins of 0.5 into a single 3 BTC output. Five are payments from this chain. Spending each coin takes its key, so most likely those five addresses had the same owner.
The change was followed output by output. The shape is that of a faucet, a site that gave away bitcoin to try it out. Whose it was has not been confirmed.
12
Aug 18, 2010, 01:43 UTC · Block 74,923
A payment to an overflow output
What can be read on the chainPayment 183 of the chain goes to 1542Dgx5…, output 1 of the overflow, 56 hours after the bad block. It is its only transaction, and that 0.5 BTC is still unspent. The chain goes on after that payment.
The other address1EDDEGtr…, output 0, has no transactions on today’s chain.
INFERENCE
It is consistent with the same person having built the overflow and asked for both payments. It does not prove it. A faucet sends to whatever address it is given, and anyone who knew how to pull that address out of the forum dump could ask for it.
The address does not appear written on the forum, because the dump had its bytes reversed. The three threads about the incident were searched.
13
For beginners
What the overflow leaves behind
Each node applies the rule
On Aug 15 the nodes accepted the block because that rule did not exist. With 0.3.10, each updated node rejected it on its own.
The warning came from a node
jgarzik posted the block his node had received. lfm explained it 47 minutes later.
Another branch was mined
Nobody edited blocks. The network mined another branch from 74,637 and kept that one.
How a node decidesIt checks each block on its own, with the rules of the software it has installed. It only counts a branch’s work if its blocks follow those rules. That is why, after updating, the bad block’s branch stopped counting for that node, even if it was longer.
Nodes that did not updateFor the old software, both branches were valid, and the node followed the longer one. When the good branch overtook the bad one, the node switched to the good one without anyone touching it.
The rule is still in today’s software, Bitcoin Core. A node rejects a transaction if one output, or the sum of the outputs, goes past 21 million BTC.
14
For beginners
A new rule and old blocks
The 2010 rule had no starting blockThe fix applied to the whole chain. That is why it made 74,638 invalid, even though it was already mined.
To clean up, blocks had to be downloaded againAt 21:40, Satoshi asked people to shut down the software, replace their saved blocks with a copy from before 74,000, update and let the rest download. The missing blocks were downloaded with the already updated software.
0.3.10 brought another checkIt was added at 22:21 (SVN 133). It rejected a new block if its branch went through the bad 74,638, recognized by its hash.
The next day, updating was enoughOn Aug 16 the good branch already had more work. An updated node switched to it on its own, without deleting anything.
Today a new rule starts at a set blockTaproot activated at block 709,632, on Nov 14, 2021. Earlier blocks are still validated with the rules of their time.
Bitcoin Core can verify the saved chain again (-reindex) or mark a block as invalid by hand (invalidateblock).
15
Read with care
What can be read on the chain and what cannot
Statement
Where it comes from
The transaction and its block are not on today’s chain
Chain
The transaction’s amounts, signature and addresses
The forum, checked with the rebuilt fingerprint, which gives the TXID
The sum comes to −0.01 and the fee to 0.51
The arithmetic, on those amounts
The miner collected 50.51 BTC
The forum (that transaction is gone too)
The 6 h 51 min gap after block 74,637
Chain
The times of the warning, the patch and 0.3.10
The forum and the code repository
The good branch overtook the bad one at block 74,691
Bitcoin Wiki. It cannot be checked on the chain
The 0.5 BTC coin is still unspent
Chain
The 183 payments up to the one to 1542Dgx5…, and that the chain goes on
Chain
The payments spent together had the same owner
Inference from the shape
The payments came from a faucet
Inference from the shape, and the wiki says “appears”
Who built the overflow
Unknown
What is on the chain, anyone can check, with the data on the next sheet.
The overflow transaction, to search for it and see that it is not there: 1d5e512a9723cbef373b970eb52f1e9598ad67e7408077a82fdac194b65333c9
Sources off the chain: Bitcoin Talk, threads 822, 823 and 827 (2010) · commit d4c6b90 in the Bitcoin repository · Bitcoin Wiki, “Value overflow incident”.
