Exploiting Forks
Many blockchains started as forks that diverged from existing crypto ledgers, and as Taiwanese security researchers have pointed out, every fork gives hackers a new way to try to falsify data.

In a Dec. 25 paper, researchers at the Institute of Electrical and Electronics Engineers outlined ways hackers can spend the same Bitcoins twice, the very thing blockchains are meant to prevent. In a Balance Attack, for instance, hackers delay network communications between subgroups of miners, whose computers verify blockchain transactions, to allow for double spending.

“We have no evidence that such attacks have already been performed on Bitcoin,” the IEEE researchers said. “However, we believe that some of the important characteristics of Bitcoin make these attacks practical and potentially highly disruptive.”

‘Sensitive Data’
A researcher from Cisco Talos, a security group, found vulnerabilities in Ethereum clients, including a bug that “can lead to the leak of sensitive data about existing accounts.” A security hole in the Parity wallet resulted in losses of $155 million in November.

In December, Youbit, an exchange in South Korea, said it would file for bankruptcy following an attack in which it lost 17 percent of its assets. The same month, mining service NiceHash said hackers stole as much as $63 million in Bitcoin from its virtual wallet.

Smart contracts -- blockchain-based programs that automate asset transfers -- are also vulnerable. In 2016, hackers stole at least $50 million out of the DAO, a venture-capital smart contract. Only an update to Ethereum allowed users to get their money back.

Programmers’ old-school mindsets are partly to blame for the technology’s flaws.

“When you have a bug, you release a patch,” Richard Ma, co-founder of Quantstamp, a company backed by venture-capital firm Y Combinator Inc. “With a smart contract, you deploy it to the network, and it’s not possible to ever change it again.”

Opportunity Knocks
But Ma sees an opportunity. In March, Quantstamp will release an automated tool that scours smart contracts for bugs. Established security firms such as McAfee Inc. may also repurpose their wares for the blockchain crowd.

“In many cases, our existing products can help secure the ecosystem,” Steve Grobman, chief technology officer of McAfee, said in a phone interview. “In general, it will be vulnerable to threats just like any other software system.”