On: Many Bitcoin wallets vulnerable to double-spending of confirmed transactions

[lappa]

Surely they verify the PoW, otherwise it would be trivial to create a long chain and attack them.

[sysk → lappa]

Indeed. I was also surprised to find this out given how popular Electrum is. The code is here: https://github.com/spesmilo/electrum/blob/master/lib/blockch... and https://github.com/spesmilo/electrum/blob/master/lib/blockch...

One could run a modified Electrum server that sends a long chain at low difficulty and double spend Electrum users.

[Pr0methean → sysk]

I read that generating that chain would be really cheap and simple too -- you just run a non-pool miner disconnected from the Internet and with an accelerated clock.