On Saturday, the Coinbase security team noticed something troubling. Someone had made a deep reorganization in the distributed ledger for Ethereum Classic, a smaller spinoff from the Ethereum coin. The attackers had pulled off the cryptocurrency equivalent of writing a bad check. The initial fraud reported by Coinbase on Monday was $460,000, but in the days that followed, the total amount rose to over $1 million, spread over 20 different transactions.