Task 1 of 3
Real Breach: The Bitcoin Negative Balance Bug
## When a Negative Number Created Money From Nothing
In 2010, Bitcoin had a critical bug. The protocol validated that transaction outputs didn't exceed inputs — but it didn't check that the amounts were positive.
A single transaction was crafted with outputs so large they wrapped around the integer limit and became negative. The result: **184 billion Bitcoin appeared out of nowhere**. At even early prices, that was an incomprehensible sum.
The Bitcoin developers patched it within hours and rolled back the chain. But it demonstrated something important: financial software that doesn't validate the *sign* of a number can be catastrophically wrong.
---
### Modern Examples
The same class of bug appears in modern fintech constantly:
- **Robinhood (2019)** — traders could open "infinite leverage" positions by exploiting how options buying power was calculated. A negative number in one field unlocked effectively unlimited funds.
- **Various exchange APIs** — transfer endpoints that accept a negative amount effectively reverse the direction of a transfer. Instead of sending money, you receive it.
---
### Why This Happens
Developers think about the *happy path*: user enters £100, £100 moves from A to B. They don't always test: what if the user enters -£100? What if they enter £999999999?
The server code might look like:
```javascript
accountA.balance -= amount; // amount = -500 → balance INCREASES
accountB.balance += amount; // accountB DECREASES
```
With a negative amount, the minus becomes a plus. Money flows backwards.