Antbleed: Massive Bitcoin backdoor could knock out 'at least half' of global hashing power

A major security flaw affecting Bitcoin mining equipment from Bitmain has the potential to knock out more than half of the global Bitcoin network's hashing power, according to reports. Called Antbleed, the backdoor allows for the remote shutdown of Bitmain's Antminer equipment including its S9, T9 and R4 platforms.

More worrying is that the backdoor code can be found openly online, including on Pastebin and GitHub, and was described as "stupidly simple" by a source speaking to Bitcoin Magazine who tested the flaw on Antminer hardware.

Antbleed works as such: every one to 11 minutes, Antminer checks-in to a central server owned by Bitmain and hands over the equipment's serial number, MAC address and IP address. Bitmain's server then sends a message back, which is usually ''true''.

However, if the response is ''false'', the code instructs the Antminer machine to stop mining. With Bitmain taking up the majority of the global bitcoin mining equipment market, it's estimated that the backdoor could shut down up to 70% of all cryptocurrency mining hardware and with it a sizeable chunk of the global hash rate.

"It's not a stretch to attribute at least half of all hash power to the vulnerable machines," reported Bitcoin Magazine.

Given that Bitmain collects personally-identifiable information, Antbleed could also be used to target specific machines and users "with the push of the button". The connection between Antminer machines and Bitmain isn't authenticated either, leaving it vulnerable to hijacking by hackers or other third parties.

An information website about the Antbleed backdoor offers information on how users can secure their Antminer equipment until a patch is released by Bitmain.

Bitmain, which is believed to have introduced the backdoor in July 2016, said in a statement: "The code running on the machines is open source, everyone can review it so no secret features exist in it. The code that was pointed out is a feature to allow owners of the Antminers to be able to remotely control their miners.

"It is not a secret and it does not provide any kind of remote control to Bitmain for the Antminers it does not own or operate in its own mining farms."