<blockquote>
  <p>How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?</p>
</blockquote>

<p>I would say extremely unlikely as discussed <a href="https://bitcoin.stackexchange.com/questions/8360/how-many-confirmations-do-i-need-to-ensure-a-transaction-is-successful">here</a>, <a href="https://bitcoin.stackexchange.com/questions/12033/how-many-confirmations-does-bitpay-wait">here</a>, <a href="https://www.reddit.com/r/Bitcoin/comments/3lp5ne/how_many_confirmations_do_you_make_your_customers/" rel="nofollow noreferrer">here</a> and <a href="https://bitcointalk.org/index.php?topic=950279.0" rel="nofollow noreferrer">here</a>. Unless you are selling small islands on the website there would be no incentive to acquire the immense resources required for an attack.</p>

CC BY-SA 3.0
2016-01-12T20:39:01.257Z
2016-01-12T20:39:01.257Z
2017-04-13T12:47:34.187Z
karask
<blockquote>
  <p>How can merchant be alerted of any double-spend attacks ?</p>
</blockquote>

<p>Running their own daemon will achieve that. </p>

<blockquote>
  <p>Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals</p>
</blockquote>

<p>Any backend services run by a merchant <em>need</em> to be able to handle block chain reorganisations anyway! They happen normally, randomly, and without malice. Shutting down is obviously not an option for an event which happens more than once a day. Not handling this behaviour will open the merchant up to rampant theft. </p>

<blockquote>
  <p>How safe is it to run an out of the box Bitcoin Daemon?</p>
</blockquote>

<p>Reasonably, the daemon is generally considered to be safe and is written in a language that is normally considered to be safe (C++). However, there have been potential code execution problems due to <code>OpenSSL</code> library and <code>miniupnp</code>. A good node would be at a minimum in a different user account, not not different hardware from production services. </p>

<blockquote>
  <p>Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?</p>
</blockquote>

<p>Bitcoin XT is irrelevant. The Bitcoin Core software does not handle alerting you to this, however the best canonical chain changing makes it fairly obvious through the RPC interface. </p>

<blockquote>
  <p>Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?</p>
</blockquote>

<p>No. Bitcoin Core is extremely intensive on CPU, IO and memory. It is an extremely harsh test of hardware and will frequently find underlying issues like disk and RAM failure better than any other test- at the cost of your stability. You don't want a vulnerable web server next to something storing money. </p>

<blockquote>
  <p>How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?</p>
</blockquote>

<p>Perhaps unlikely. </p>

CC BY-SA 3.0
2016-01-13T16:57:38.783Z
Please don’t answer question lists, instead flag them as "too broad" or "low-quality". They don’t work well on our platform and will probably be heavily edited or deleted. If you have put time into it already then, it makes us feel bad when we clean it up, because you’ve probably wasted most of your time.
Murch
CC BY-SA 3.0
2016-01-12T17:43:29.943Z
2016-01-12T17:43:29.943Z
Claris
<p>How can merchants be alerted of Double-spending attacks? Let us take a hypothetical case where a merchant offer a BTC deposit wallet to his users, User deposits Bitcoins and it's credited to his account on 6 confirmations. Let's say, theoretically, the attack has been pulled off and he got his bitcoins back + the funds on the wallet remained as the database haven't been updated due to no alerts of any double spend attacks.</p>

<p>Question regarding this scenario:</p>

<ul>
<li>How can merchant be alerted of any double-spend attacks ?</li>
<li>Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals</li>
<li>How safe is it to run an out of the box Bitcoin Daemon?</li>
<li>Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?</li>
<li>Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?</li>
<li>If a double-spend attack is pulled off, how to manually verify transactions via the bitcoin daemon and how to know how much amount lost ? Will the saved transaction hash can be re-usable to obtain info about the transactions using gettransaction?</li>
<li>How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?</li>
</ul>

<p><strong>:::UPDATES:::</strong></p>

<p>I've read most of the answers and seems nobody is able to answer this question:</p>

<ul>
<li><p>If a double-spend attack is pulled off, how to manually verify transactions via the bitcoin daemon and how to know how much amount lost ? Will the saved transaction hash can be re-usable to obtain info about the transactions using gettransaction?</p></li>
<li><p>Will the attack be able to pull off after 48 hours?</p></li>
</ul>

CC BY-SA 3.0
2016-01-13T09:44:53.020Z
Note about XT: don't confuse 0 confirmation doublespend relay (what XT does, and thereby opening the network to DDOS attack) with doublespending after 6 confirmations. XT doesn't do anything different there.
Jannes
CC BY-SA 3.0
2016-01-13T16:47:53.980Z
Hi Alessandro, Welcome to Bitcoin.SE. In order to get good answers, please ask **one specific question per post**. You have asked a broad range of questions that should be **separate posts**. Please edit this question down to one topic and then flag for reopening. I suggest a split along this lines: 1. How can a merchant get alerted of doublespend attacks? 2. How likely is the success of a doublespend attack after six confirmations? 3. How does one safely run a Bitcoin Daemon? 4. How much bandwidth does the Bitcoin daemon consume? … **Please make each its own post!**
Murch
CC BY-SA 3.0
2016-01-13T17:02:44.283Z
For a longer explanation please see [How to deal with question posts containing several different questions?](http://meta.bitcoin.stackexchange.com/q/695/5406)
Murch
<bitcoind><bitcoin-core><doublespend><merchants><bitcoin-xt>
Paranoid Merchants on double spending
Alessandro Genovese
# Paranoid Merchants on double spending

(Asked by: username_0 on 2016-01-12)

How can merchants be alerted of Double-spending attacks? Let us take a hypothetical case where a merchant offer a BTC deposit wallet to his users, User deposits Bitcoins and it's credited to his account on 6 confirmations. Let's say, theoretically, the attack has been pulled off and he got his bitcoins back + the funds on the wallet remained as the database haven't been updated due to no alerts of any double spend attacks.

Question regarding this scenario:

* How can merchant be alerted of any double-spend attacks ?
* Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals
* How safe is it to run an out of the box Bitcoin Daemon?
* Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?
* Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?
* If a double-spend attack is pulled off, how to manually verify transactions via the bitcoin daemon and how to know how much amount lost ? Will the saved transaction hash can be re-usable to obtain info about the transactions using gettransaction?
* How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?

**:::UPDATES:::**

I've read most of the answers and seems nobody is able to answer this question:

* If a double-spend attack is pulled off, how to manually verify transactions via the bitcoin daemon and how to know how much amount lost ? Will the saved transaction hash can be re-usable to obtain info about the transactions using gettransaction?
* Will the attack be able to pull off after 48 hours?

**Tags:** bitcoind, bitcoin-core, doublespend, merchants, bitcoin-xt

> **Comments:**
> **username_1**: Note about XT: don't confuse 0 confirmation doublespend relay (what XT does, and thereby opening the network to DDOS attack) with doublespending after 6 confirmations. XT doesn't do anything different there.  
> **username_2**: Hi Alessandro, Welcome to Bitcoin.SE. In order to get good answers, please ask **one specific question per post**. You have asked a broad range of questions that should be **separate posts**. Please edit this question down to one topic and then flag for reopening. I suggest a split along this lines: 1. How can a merchant get alerted of doublespend attacks? 2. How likely is the success of a doublespend attack after six confirmations? 3. How does one safely run a Bitcoin Daemon? 4. How much bandwidth does the Bitcoin daemon consume? … **Please make each its own post!**  
> **username_2**: For a longer explanation please see [How to deal with question posts containing several different questions?](http://meta.bitcoin.stackexchange.com/q/695/5406)  

---

## 2 answers

### Answer by username_3 on 2016-01-12. Score: 1

> How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?

I would say extremely unlikely as discussed [here](https://bitcoin.stackexchange.com/questions/8360/how-many-confirmations-do-i-need-to-ensure-a-transaction-is-successful), [here](https://bitcoin.stackexchange.com/questions/12033/how-many-confirmations-does-bitpay-wait), [here](https://www.reddit.com/r/Bitcoin/comments/3lp5ne/how_many_confirmations_do_you_make_your_customers/) and [here](https://bitcointalk.org/index.php?topic=950279.0). Unless you are selling small islands on the website there would be no incentive to acquire the immense resources required for an attack.


---

### Answer by username_4 on 2016-01-12. Score: 1

> How can merchant be alerted of any double-spend attacks ?

Running their own daemon will achieve that.

> Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals

Any backend services run by a merchant *need* to be able to handle block chain reorganisations anyway! They happen normally, randomly, and without malice. Shutting down is obviously not an option for an event which happens more than once a day. Not handling this behaviour will open the merchant up to rampant theft.

> How safe is it to run an out of the box Bitcoin Daemon?

Reasonably, the daemon is generally considered to be safe and is written in a language that is normally considered to be safe (C++). However, there have been potential code execution problems due to `OpenSSL` library and `miniupnp`. A good node would be at a minimum in a different user account, not not different hardware from production services.

> Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?

Bitcoin XT is irrelevant. The Bitcoin Core software does not handle alerting you to this, however the best canonical chain changing makes it fairly obvious through the RPC interface.

> Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?

No. Bitcoin Core is extremely intensive on CPU, IO and memory. It is an extremely harsh test of hardware and will frequently find underlying issues like disk and RAM failure better than any other test- at the cost of your stability. You don't want a vulnerable web server next to something storing money.

> How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?

Perhaps unlikely.

> **Comments:**
> **username_2**: Please don’t answer question lists, instead flag them as "too broad" or "low-quality". They don’t work well on our platform and will probably be heavily edited or deleted. If you have put time into it already then, it makes us feel bad when we clean it up, because you’ve probably wasted most of your time.  

---

