Yesterday, our team found a bug in our implementation of Zerocoin. A typographical error on a single additional character in code allowed an attacker to create Zerocoin spend transactions without a corresponding mint. We have identified the error and are pushing the fix urgently within the next 24 hours. We urge all pools and exchanges to update once the release is out.
From what we can see, the attacker (or attackers) is very sophisticated and from our investigations, he (or she) did many things to camouflage his tracks through the generation of lots of exchange accounts and carefully spread out deposits and withdrawals over several weeks. We estimate the attacker has created about 370,000 Zcoins which has been almost completely sold except for about 20,000+ Zcoin and absorbed on the market with a profit of around 410 BTC. In other words, the damage has already been mostly absorbed by the markets.
To clarify a few things:
The exploit happened due to the bug in the code and not from any weakness in the cryptography. The bug from the typo error allowed the attacker to reuse his existing valid proofs to generate additional Zerocoin spend transactions. The anonymity of Zerocoin has not been compromised. We knew we were being attacked when we saw that the total mint transactions did not match up with the total spend transactions. If our total supply was not verifiable due to hidden amount transactions, we would not have been able to discover this bug.Despite the severity of the hack, we will not be forfeiting or blacklisting any coins. Trading will resume once pools and exchanges have had time to update their code. A new release will be pushed out pretty soon.
Prior to this announcement we had disclosed the hack to the exchanges for them to assist in our investigations. We thank you for understanding and apologize for the silence today as we had to make sure we had all the relevant facts before making a statement on the same.
We would also like to thank everyone who has assisted on this matter and will be posting further details in a later post.