184 Billion Bitcoin: The Scariest Bugs in Crypto History

Bitcoin’s supply is capped at 21 million coins. For a few hours on a Sunday in August 2010, the ledger disagreed by about 184 billion. This is a tour of the moments crypto’s code broke: an integer that wrapped around, a database setting that split a network, a withdrawal function written in the wrong order, a library contract killed by a stranger, and a bug that could have printed bitcoin and went unnoticed for eighteen months. The same thing fixed every one of them, and it was never the code.

August 2010: the day Bitcoin printed 184 billion coins

On August 15, 2010, a Sunday, developer Jeff Garzik flagged a block on the Bitcointalk forum titled “Strange block 74638.” The block contained a transaction with two outputs of 92,233,720,368.54 BTC each, 184,467,440,737 coins in total, paid out of an input of half a bitcoin that had come from a faucet.

The cause was arithmetic, not cryptography. Bitcoin stores amounts as 64-bit signed integers, counting in satoshis. The code checked that no single output was negative and that the inputs covered the outputs, but it summed the outputs first, and two values that large wrap past the maximum into a small negative number. A negative total looked like a generous fee. The transaction passed.

Within the hour a second thread was open demanding a fix; by mid-evening Gavin Andresen had posted a quick patch, and Satoshi Nakamoto a fuller one. Within five hours Bitcoin 0.3.10 was out, with a new rule: no output, and no total of outputs, may exceed 21 million coins. Upgraded nodes rejected block 74,638 and started again from 74,637. The honest chain overtook the bad one at block 74,691, 53 blocks later, and the transaction ceased to exist in Bitcoin’s history. The half-bitcoin input is reportedly still sitting there, never spent.

Bitcoin Core’s transaction check today. The comment cites the 2010 bug by its CVE number, and every node that runs the software will  #9 inherit  a rule drafted in a hurry on a Sunday in August 2010. Source: bitcoin/bitcoin, src/consensus/tx_check.cpp.

March 2013: the fork nobody planned

Bitcoin 0.8 swapped its database engine from Berkeley DB to LevelDB, and nobody thought of that as a change to the rules. On March 11, 2013, a miner running 0.8 produced block 225,430, which carried more transaction inputs than any block before it. Older 0.7 nodes, limited to 10,000 Berkeley DB locks, choked on it and rejected the block as invalid. For about six hours, two Bitcoin networks existed, each convinced it was the real one.

The fix was social. Developers and the largest mining pools gathered on IRC, and the pools running 0.8 voluntarily downgraded to 0.7 so that the shorter, older chain could win. The split closed 24 blocks later at height 225,454. One known double spend of about $10,000 hit the payment processor OKPay during the window. The postmortem became BIP 50, and its lesson is uncomfortable: anything that changes which blocks a node accepts is a consensus change, whether or not the specification says so.

June 2016: The DAO

The DAO raised about $150 million worth of Ether in the spring of 2016, around 14% of all ETH in existence, into a single smart contract. On June 17, an attacker began draining it through the function that let holders split off into a child DAO, exploiting its order of operations. It sent the ether first and then zeroed the sender’s balance, next to a comment in the code that read “be nice, and get his rewards”. Call it again before the first call finishes, and the contract pays again. About 3.6 million ETH drained out within hours, worth roughly $50 million at the time and more than $8 billion at today’s prices.

The stolen ether landed in a child contract with a built-in waiting period, which gave Ethereum a few weeks to argue with itself. On July 20, at block 1,920,000, the network hard-forked and moved the funds into a recovery contract. Those who refused on principle kept mining the original chain, which still runs as Ethereum Classic. “Code is law” acquired a footnote that day.

November 2017: “I accidentally killed it”

Parity’s multisig wallets were thin contracts that delegated their logic to one shared library. On July 19, 2017, an attacker used an exposed initialization function to take over three project wallets and stole 153,037 ETH, about $30 million then. Parity fixed the bug and redeployed the library the next day. The new library had one problem: nobody had initialized it.

On November 6, a GitHub user called devops199 did. They ran the library’s initialization function, which made them its owner. Then they called kill. With the library gone, every wallet that depended on it became a shell that could receive ether and never send it. 587 wallets holding 513,774 ETH froze in a single transaction: about $150 million at the time, around $1.2 billion with ETH near $2,300. devops199’s explanation on GitHub was four words long: “I accidentally killed it”.

The community debated proposals to restore the funds through a protocol change through 2018 and rejected them. The ether is still there. It will outlast this article.

September 2018: the bug that could have printed bitcoin

In March 2017, Bitcoin Core 0.14.0 shipped a performance optimization that skipped a check for transactions spending the same input twice; in that version, it crashed. A redesign in 0.15 that September changed the failure quietly: a miner could now include a transaction spending the same coin twice, and nodes running 0.15.0 through 0.16.2 would have accepted it. That is inflation, the one thing Bitcoin exists to prevent. The flaw sat in the most widely run Bitcoin software on earth for about eighteen months, with the last twelve in its dangerous form.

On September 17, 2018, an anonymous reporter, later revealed to be a pseudonymous developer from the Bitcoin Cash side of a bitter schism, privately sent it to Bitcoin Core maintainers as a crash bug. Within three hours, Matt Corallo recognized the inflation potential. A fix was tagged that night and released as 0.16.3 the next day; mining pools upgraded first, quietly. The maintainers initially published only the denial-of-service half of the story so that an attacker reading the release notes would not learn the rest. Full disclosure followed on September 20. The bug was never exploited on mainnet. It was exploited on testnet shortly afterward, just to prove the point.

August 2022: the bridge that let everyone in

Cross-chain bridges hold assets on one chain and release them on another when a message proves a deposit happened. On June 21, 2022, a routine Nomad bridge upgrade set its trusted root to zero. Because an unproven message also has a root of zero, every message now counted as proven. Nobody noticed for six weeks.

On the evening of August 1, the first attacker worked that out. Hundreds of others then realized they only had to copy the attacker’s transaction, paste in their own address, and resubmit it. In about eight hours, around $190 million left the bridge across more than 300 addresses, in what the security researcher samczsun called a “frenzied free-for-all”. Roughly $36 million came back from people who later described themselves as white hats. The rest did not.

What the monsters have in common

None of these were fixed by code. A developer noticed a strange block. Pool operators downgraded their software on a Monday night because people they trusted asked them to. Maintainers spent an evening deciding how much of a bug to tell the world about. A community voted to rewrite its own history. In the one case where the rules said nobody could intervene, nobody did, and the ether is still frozen.

For anyone holding or moving crypto in 2026, that history translates into a few habits. Keep wallet and node software updated; people who could upgrade quickly resolved both the 2013 fork and the 2018 bug. Treat a newly deployed contract as untested until it has survived contact with money and time, which is the same logic our honeypot guide applies to new tokens. Keep as little as possible sitting inside bridges and pooled contracts between uses, because a contract that breaks takes everything inside it along. And remember that a swap service, ours included, can move you into an asset but cannot move you out of a contract whose code refuses to cooperate.

SimpleSwap is built around that last line. Swaps move wallet to wallet, with no long-term balance kept on the platform, so no account of yours sits in anyone’s contract between swaps. You choose the checks that remain, the receiving address, and the network.

Our only official domain is simpleswap.io.