  Since Bitcoin appeared in 2009, over 6,000 different cryptocurrency projects
have followed. The cryptocurrency world may be the only technology where a
massive number of competitors offer similar services yet claim unique benefits,
including scalability, fast transactions, and security. But are these projects
really offering unique features and significant enhancements over their
competitors? To answer this question, we conducted a large-scale empirical
analysis of code maintenance activities, originality and security across 592
crypto projects. We found that about half of these projects have not been
updated for the last six months; over two years, about three-quarters of them
disappeared, or were reported as scams or inactive. We also investigated
whether 11 security vulnerabilities patched in Bitcoin were also patched in
other projects. We found that about 80% of 510 C-language-based cryptocurrency
projects have at least one unpatched vulnerability, and the mean time taken to
fix the vulnerability is 237.8 days. Among those 510 altcoins, we found that at
least 157 altcoins are likely to have been forked from Bitcoin, about a third
of them containing only slight changes from the Bitcoin version from which they
were forked. As case studies, we did a deep dive into 20 altcoins (e.g.,
Litecoin, FujiCoin, and Feathercoin) similar to the version of Bitcoin used for
the fork. About half of them did not make any technically meaningful change -
failing to comply with the promises (e.g., about using Proof of Stake) made in
their whitepapers.

Cryptography and Security