Task 1 of 3

Real Breach: The Bitcoin Negative Balance Bug

## When a Negative Number Created Money From Nothing In 2010, Bitcoin had a critical bug. The protocol validated that transaction outputs didn't exceed inputs — but it didn't check that the amounts were positive. A single transaction was crafted with outputs so large they wrapped around the integer limit and became negative. The result: **184 billion Bitcoin appeared out of nowhere**. At even early prices, that was an incomprehensible sum. The Bitcoin developers patched it within hours and rolled back the chain. But it demonstrated something important: financial software that doesn't validate the *sign* of a number can be catastrophically wrong. --- ### Modern Examples The same class of bug appears in modern fintech constantly: - **Robinhood (2019)** — traders could open "infinite leverage" positions by exploiting how options buying power was calculated. A negative number in one field unlocked effectively unlimited funds. - **Various exchange APIs** — transfer endpoints that accept a negative amount effectively reverse the direction of a transfer. Instead of sending money, you receive it. --- ### Why This Happens Developers think about the *happy path*: user enters £100, £100 moves from A to B. They don't always test: what if the user enters -£100? What if they enter £999999999? The server code might look like: ```javascript accountA.balance -= amount; // amount = -500 → balance INCREASES accountB.balance += amount; // accountB DECREASES ``` With a negative amount, the minus becomes a plus. Money flows backwards.