Monero Eyes ‘Detective Mining’ Defense After Qubic Attack

Monero (XMR) developers and pool operators are weighing a swift, software-level response to last week’s hashrate shock after the Qubic mining pool claimed it had briefly dominated the network and triggered a six-block reorganization. Former Monero lead maintainer Riccardo Spagni proposed deploying “detective mining,” a pool-side strategy he says can neutralize selfish-mining attacks without a hard fork. “A proposal to make Monero completely resilient to selfish-mining attacks, no protocol changes needed,” Spagni wrote, linking to a new Monero Research Lab issue that outlines the approach.

Qubic’s campaign culminated on Aug. 12 with public statements that it had surpassed 51% of Monero’s hashrate and “successfully reorganiz[ed] the blockchain,” part of what the project billed as a live “51% takeover demo.” Qubic itself characterized its method as “selfish mining,” a tactic that can win outsized rewards with as little as “33–40%” of hashrate, not necessarily a full majority.

Risk controls kicked in across the industry. Kraken posted a status notice in mid-August that it had paused XMR deposits “after detecting that a single mining pool has gained more than 50% of the network’s total hashing power,” keeping trading and withdrawals open while it monitored network integrity. The pause underscored how even short-lived reorganizations—Monero targets two-minute blocks, making six blocks roughly twelve minutes—can force exchanges to reassess confirmation policies.

Not everyone accepted Qubic’s framing. Analysts at the RIAT Institute argued “no 51% attack has happened,” citing data suggesting Qubic’s peak contributed far less than a true majority and noting that a six-block reorg is insufficient proof of sustained control capable of reversing fully confirmed transactions.

Detective Mining Could Shield Monero

Spagni’s “detective mining” proposal seeks to collapse the advantage of any pool attempting selfish mining by exploiting information already exposed in pool job messages. In pooled mining, Stratum job payloads include the previous block hash (“prevhash”). A detective miner (or a pool running a “sensor” proxy) subscribes to competing pools’ job streams; when a leaked prevhash doesn’t match the public tip, the pool immediately builds and broadcasts a valid child on top of the attacker’s hidden parent, forcing the selfish miner to reveal or lose its private lead. Because this operates entirely at the pool/Stratum-proxy layer, it requires “no consensus or protocol changes,” making it deployable on today’s Monero stack.

The economics are the point. Spagni’s summary of the underlying Lee–Kim model (2019) claims that if roughly half of network hashrate (i.e., the largest pools) adopt detective mining, the selfish miner’s break-even threshold jumps into the ~32–42% range depending on tie-breaking assumptions—eroding the attack’s profitability and, with wider adoption, wiping it out across tested splits. That is a materially higher hurdle than the classical Eyal–Sirer result, under which selfish mining can be profitable around one-quarter to one-third of hashrate.

Spagni’s issue also anticipates adversarial counter-moves. It recommends quorum-based detection from multiple sensors, short “grace windows” before diverting hashrate, and share-submission checks to defeat decoy jobs—all with rate limits and telemetry to tune false-positive risk. These are pragmatic pool-operator playbooks rather than protocol-level rules, aligning with Monero’s preference to harden incentives and operations before touching consensus.

For Monero, the next steps will be social as much as technical: major pools would need to ship and enable detective-mining logic for the defense to bite at the modeled thresholds. As of Aug. 19, the idea is a public proposal under active discussion rather than an adopted standard. But after a week in which a single pool’s campaign produced a measurable reorg and exchange-level mitigations, the path of least friction—pool software updates that raise the cost of selfish mining—has quickly become the center of gravity for the project’s short-term response.

At press time, XMR traded at $268.