The following is an account of NewYorkCoin’s web presence from March 2014 until December 2017, prior to the current involvement of the Community Development Team and the NYCoin Community.

(2014) NYC Genesis Block & Lost Momentum:

Charlie Kartchner AKA “Charlie K.” was integral in creating what was then called, the “New York Coin Foundation,” although no formal foundation was registered in the State of New York. Apparently, NYC had problems securing a full development team to maintain and improve the source code.

(2015–2016) TronREX Attempts Takeover & Re-brand:

In 2015, TronREX attempts a re-branding campaign for NYC, using the URL newyorkcoin.xyz but it quickly lost momentum. Github & Bitcointalk user “Wargo” forked the NYC Github repository to update the code in order to match Litecoin’s code updates. In August 2015, Coingather Exchange lists NYC.

For more detailed information regarding the TronREX take over please see the following thread — https://bitcointalk.org/index.php?topic=619708.960

(Early 2017) Charlie K. & NewYorkCoin.net Reboot:

In July 2017, Charlie K. attempts to resurrect NYC by creating a website using the URL newyorkcoin.net and answering the nycoinfoundation@gmail.com email. Through his efforts, NYC gets listed on Yobit Exchange on October 19, 2017. Between July 2017 and November 2017, the market cap fluctuates between $300,000 and $4 million.

In November 2017, CoinGather Exchange is shut down and seized by the FBI for allegedly operating an unlicensed money transmission business, thus locking up billions of NYC that were in CoinGather’s wallets. Yobit then becomes the only exchange on which NYC is traded.

(Late 2017) James Burrell Learns About NYC And Grassroots Community Building Commences:

On November 22, 2017, James Burrell II meets Charlie K. for the first time at a NYC Meetup hosted by Charlie in Washington Square Park. Since Charlie K. lived outside of New York City, he asked James to host subsequent NYC Meetups in an effort to make a grassroots movement to build a community of cryptocurrency enthusiasts for NYC. On December 20, 2017, James hosts a small NYC Meetup in Washington Square Park and meets members of the team from Mining Dutch Pool, who became interested in mining NYC.

(2017–2018) Market Cap Increases Dramatically:

From December, 2017 through January, 2018, BTC reaches an all time high and the NYC market cap goes from $4 million to an all time high of $125 million on January 7, 2018. Around this time, Coinomi integrates NYC into their mobile wallet as a result of the efforts of Charlie K.

The following is a brief history of the creation of the modern day Community Development Team, and creation of the NYCoin Community. Followed by a description of the hard fork and analysis of the recent 51% attack.

(Early 2018) Formation of the Community Development Team & Modern NYCoin Community:

January 4, 2018 marks the creation of the Community Dev Team and the beginning of their involvement in NYC. Charles Fulnecky, AKA “Cmelion” contacts nycoinfoundation@gmail.com in response to a Bitcointalk forum post seeking cryptocurrency development help and Charlie K. responds to Cmelion requesting help with NYC development.

Cmelion starts searching for former NYC developers and miners, and through his mining activity, meets Hobbyist, the administrator for the Hobbyist Pool and an experienced cryptocurrency miner, Hobbyist had been mining NYC for several years. On January 14, Cmelion forks the original NYC repository to begin updating the code.

January 17, 2018, James hosts an NYC Meetup at Keats Bar in New York City, and meets Cmelion in person for the first time. This Meetup obtained major press from Crains Business New York and also energized the creation of the “NYCoin Community.”

The original Discord server was created around this time and was owned by user “dkbigmoney” and user “cryptocurious.” On January 19, 2018, Hobbyist joins the newly created Discord and the Community Development Team starts to take shape. Developers “LTA,” “Nicovs,” and “MrSlosh” are brought into the fold, with “dkbigmoney” handling marketing and the social channels. All progress made to NYC at the time had been the result of volunteers, who saw an opportunity to make a meaningful impact on a cryptocurrency that had apparently been left for dead.

Unfortunately, as with many other cryptocurrency communities, there were other community members, such as “earthfunds” “dkbigmoney” and even Charlie K., who didn’t envision the same collaborative culture that was being built by the NYCoin Community and Development Team.

(2018) Security Improvements & Inflation Reduction Hard Fork:

In response to the attacks on other coins such as Verge, the Community Development Team decided that a hard fork would be necessary to make improvements to security and reduce inflation.

As part of the hard fork, the difficulty algorithm would be changed from Kimoto Gravity Well to Digishield, it would now become an Auxiliary Proof of Work (“AuxPoW”) coin so that it could be merge-mined with other Scrypt based coins such as DOGE, and lastly, block reward halving was implemented, block rewards would now be cut in half every 500,000 blocks, from the pre-fork block reward of 10,000 NYC, all the way down to 625 NYC, with 2 final reductions, one to 100 NYC, then ending at a final block reward of 50 NYC. The team considered adding Advanced Checkpointing, which could also prevent attacks from older untrustworthy nodes, but the team realized the centralization issues surrounding Advanced Checkpointing and did not include it in the hard fork.

The Community Development Team and other members of the NYCoin Community raised funds to update the Coinomi Wallet to the new code, and also built relationships with major mining pools and exchanges to request their nodes to run the updated code in order to prevent a confusing chain split. These efforts were mostly successful except for Yobit Exchange, which refused to communicate its intentions to the team.

For educational purposes and disclosure, the Community Devs alerted the community to the vulnerabilities that had always existed within the core code, as well as in many other POW coins. Through regular posts online in the Community’s Telegram channels and Discord, the team reiterated best-practices for coin holders, such as maintaining their coin in wallets that provided access to the private keys, not on exchanges. What was well-known at the time was that the hard fork was expected to occur in late October, 2018.

(2018) Discord Attack, Compromised Wallets, and 51% Attack to Disrupt Hard Fork:

Since “cryptocurious,” who launched the original NYC Discord, was inactive for an extended amount of time, and thus there was no active members with admin privileges. At this time “dkbigmoney,” put in a request to Discord and knew that he would gain sole control from “cryptocurious” after another period of inactivity. Once that time of inactivity passed, “dkbigmoney” became the sole admin for the NYC Discord.

On October 9th, 2018 “dkbigmoney” suddenly and without disclosing his intent, sold the NYC Discord to user “earthfunds,” who had made it known to the team that he wanted to be in sole control of the destiny of NYC. By purchasing the Discord server, “earthfunds” now owned a Discord server that had thousands of members thus making it easy for him to manipulate the community how he saw fit.

After conversing with “earthfunds” regarding the Discord server, “MrSlosh” made the recommendation to the team that all content be moved to a new Discord server owned by Hobbyist for the preservation of the NYC team. The team agreed that content should be copied in preparation for the move. Some team members, concerned with disruption just prior to the impending fork, suggested to continue observing the Discord before making any announcements. However, only hours after the purchase of the server, “earthfunds” began removing administrator privileges from team members, which proved to be the last straw.

The team, upset with the way things had transpired, organized dozens of members from the community to copy content from the old server to the new server, posting messages in all channels informing the community of the move to the new server. Immediately, “earthfunds” started removing core team members from the server. Shortly after gaining complete control “earthfunds” deleted all content from the server and renamed it to “King Kong Bitcoin.” Sadly, despite the team acting quickly to backup the Discord history, a great deal of history was lost.

The team, still shaken up by recent developments, decided to limit access to GitHub, ensuring that Two Factor Authentication is strictly enforced. Also on October 9th, 2018, the same day as the Discord server problem, a few of the NYC GitHub wallet releases became infected with malware.

On October 30th, the Community Development Team discovered these infected wallet releases and quickly started to investigate. During the investigation, two major flaws in the general security of GitHub were discovered.

The first flaw was that any account within the organization can access any of the wallet release assets, even for repositories for which they do not have permissions. The second flaw was that all changes after the initial publish event of the wallet releases are silent and don’t trigger the GitHub web hook notifications. All changes made by members of the NYC GitHub Organization trigger an email and Discord notification, except changes in the wallet releases, which are arguably for a cryptocurrency the most important changes for requiring notifications. The team was able to identify the account used to change the wallet releases, and unfortunately, it was the GitHub account of a former community contributor who didn’t know about the compromised account.

Even though this account had no administrator privileges, the account of this contributor was compromised, as the account did not have Two Factor Authentication deployed, the attackers used Eastern European IP addresses. GitHub has been informed of both security flaws in its internal code.

(Late 2018) Full Analysis of 51% Attack:

The Community Development Team strongly suspects that at most, the malware infected wallets acted as distraction for the 51% attack, rather than a facilitator of the attack. Contrary to theories published on other social channels, the few NYC wallets that contained malware absolutely had no role in the actual attack itself.

During the relevant time period, the team observed hash rates as high as 600GH/s at the peak of the attack. To argue that this increased hash rate was derived from infected wallets is simply not possible. Even if all the computers with affected NYC wallets were on and running during the attack, the hash rate could not approach the levels observed during the 51% attack. Even if every infected wallet was on a computer powered by an Intel Core I7 5820K processor, it would require 465,116 infected computers to reach a mere 10% of the observed hash rate. The team speculates that in cases such as this, the 51% attack was carried out by the use of large amounts of rented hash rate to seize control of the coin with the intent to exploit it. The Community Development Team has categorically rejected the notion that the wallets containing malware were used to carry out the attack.

Going forward the Community Development Team has limited administrator access to two individuals at a time, those individuals have real world identities tied to their accounts and Two Factor Authentication is strictly enforced. While limiting access and using Two Factor Authentication reduces the risk of hackers cracking passwords to gain access, and the use of mandatory pull-requests and code reviews limits the potential for injecting malware into the source code, it does not prevent modifying the releases “silently.” To counter this threat, the Community Development Team has developed their own notification system, now, every change made to the NYC wallet releases gives the developers a warning/notification.

Based on current forensic analysis by the Community Development Team, the 51% attack started on October 10th, only two days after the takeover of Discord and the infected wallet releases.

As the team started to notice sudden peaks in hash rate, they suspected the peaks were due to abuse of the network by larger mining pools to increase the likelihood that such pool would get most, if not all of the block rewards prior to the block reward reduction. The Community Development Team had observed this activity in the past, which was one of their initial motivators for the security hard fork.

On October 16th, 2018, the team started to notice more orphaned blocks due to the sudden peaks in hash rate. Still convinced the orphaned blocks were caused by abuse of larger mining pools, the team started warning the community to be careful with sending NYC, as avoiding the sudden peaks and sending small amounts first would reduce the likelihood of unconfirmed transactions.

On October 20th, 2018, Yobit Exchange locked users from being able to deposit or withdraw NYC without any statement alerting users as to why. The team, as well as many in the community thought that Yobit wallets were simply locked due to Yobit possibly updating the source code for the upcoming hard fork.

Once Yobit Exchange had locked its wallets, the attackers migrated to TradeSatoshi Exchange, the coins second most liquid exchange at the time, on October 21st.

Members of the community speculated as to what was happening to the network during the attack and why there was a massive influx of NYC offered for sale at historically low prices; some community members thought it was fear of the upcoming fork, or a huge supply of NYC from Coingather Exchange, which had been seized as stated above. The huge supply was actually an attacker (or attackers) who were double-spending NYC by sending large amounts to exchanges, exchanging those NYC for another cryptocurrency, and withdrawing the replaced cryptocurrency.

The Community Development Team and other members of the community did not immediately assume that the network had been attacked; history shows a cryptocurrency can have massive market price losses before a hard fork due to fear of the network performance after the hard fork.

On October 21st, TradeSatoshi wasn’t able to continue filling NYC withdrawals, and on October 22nd, they made the decision to stop trading and contacted the team. The damages from the attack could have been mitigated if the exchanges timely communicated the unusual activity and unconfirmed transactions to the team. Yobit never informed the team and is still trading “fake” coins to this day, Crex24 never informed the team and traded “fake” coins until November 11th, and then cut off customers entirely from accessing their NYC. Notably, Tradesatoshi stopped trading and contacted the team as soon as they knew what was going on, and they have implemented an NYC Refund Token as a way to compensate its users for losses, but the relationship with TradeSatoshi is likely irreparably harmed due to the attack. Yobit Exchange still hasn’t communicated its intentions regarding when it plans to unlock its users wallets for deposits and withdrawals and the team is not optimistic given Yobit’s historical reputation regarding other coins.

That being said, NYCoin has survived this attack through implementing additional security measures, using redundancies, and limiting access to certain channels.

NYCoin Community Information Sources:

The Community Development Team and the NYCoin Community urges coin holders to obtain NYC related news and updates from official accounts/websites under control of the Community Development Team and the NYCoin Community. The official accounts/websites of the team are listed below and they are followed by a list of active/inactive accounts/websites that users should avoid getting their NYC news and updates from, as they are not controlled by the team.

Readers who are interested in getting complete and vetted information regarding NewYorkCoin should visit only the following four official sources:

https://nycoin.community

https://blog.nycoin.community/

https://www.facebook.com/NewYorkCoinCommunity/

https://twitter.com/nycoincommunity

The following links are for current & former NYC websites/accounts unrelated to the official Community Development Team, we urge coin holders not to use these links as reliable sources for news and updates from the official team:

https://newyorkcoin.net

https://nycoin.net

https://twitter.com/NewYorkCoinNYC

https://www.facebook.com/NewYorkCoin/

https://www.reddit.com/r/NewYorkCoin/

https://bitcointalk.org/index.php?topic=2016963.0

https://bitcointalk.org/index.php?topic=520400.0

http://newyorkco.in