2024/10/15 by Minfeng Qi, Qin Wang, Qi, Minfeng +12
Biochemistry, Genetics and Molecular Biology · Medicine · #Computational Engineering #Cryptography and Security (cs.CR) #Emerging Technologies (cs.ET) #FOS: Computer and information sciences #Finance #Melanoma and MAPK Pathways #Peptidase Inhibition and Analysis #Signaling Pathways in Disease #and Science (cs.CE)
paper · pdf · doi:10.48550/arxiv.2410.11295
openalex publication_date 2024/10/15 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
BRC20 tokens are a type of non-fungible asset on the Bitcoin network. They allow users to embed customised content within Bitcoin's satoshis. The token frenzy reached a market size of US$2.811 b (2023Q3--2025Q1). However, this intuitive design has not undergone serious security scrutiny. We present the first analysis of BRC20's transfer mechanism and identify a new attack vector. A typical BRC20 transfer involves two "bundled" on-chain transactions with different fee levels: the first (i.e., Tx1) with a lower fee inscribes the \textsftransfer request, while the second (i.e., Tx2) with a higher fee finalizes the actual transfer. An adversary can send a manipulated fee transaction (falling between the two fee levels), which causes Tx1 to be processed while Tx2 is pinned in the mempool. This locks BRC20 liquidity and disrupts normal withdrawal requests from users. We term this the BRC20 pinning attack. We validated the attack in real-world settings in collaboration with Binance researchers. With their knowledge and permission, we conducted a controlled test against Binance's ORDI hot wallet, resulting in a temporary suspension of ORDI withdrawals for 3.5 hours. Recovery was performed shortly after. Further analysis confirms that the attack can be applied to over 90% of inscription-based tokens within the Bitcoin ecosystem.