UPDATED | January 7, 2019 (23:30 UTC):
Ethereum Classic tweeted that Coinbase "did not connect with ETC personnel regarding the attack" after claiming to see double spends as early as January 5. Ethereum Classic is still investigating the incident and believes it may be the result of selfish mining.
UPDATED | January 7, 2019 (20:35 UTC):
Coinbase has claimed it noticed "a deep chain reorganization of the Ethereum Classic blockchain that included a double spend" on Saturday, January 5. Mark Nesbitt, writing on the exchange's blog, says there have been eight more reorganizations with double spends – worth over 88,000 ETC (around $460,000) – on the network. It's unclear whether Coinbase alerted Ethereum Classic, which, as of January 6, said the network appeared to be "operating normally."
ORIGINAL | January 7, 2019:
Bitfly, which operates the Etherchain block explorer and Ethernodes node explorers as well as an ETC mining pool, has confirmed that the Ethereum Classic network has been hit with a 51 percent attack. With at least 51 percent of the network's hashpower, an attacker is able to put their own (longer) chain on the network and "reorganize" the blockchain. There are multiple malicious strategies available to a person or persons with 51 percent of a network's hashpower, double spends being one of them.
CoinNess, an apparently China-based coin journal that claims funding from Huobi Global, ZhenFund, and FreesFund, first reported late on January 6 that SlowMist – a blockchain security company, also in China – had warned that the Ethereum Classic network might be experiencing a 51 percent attack.
Through its Twitter account, Ethereum Classic pointed to the BlockScout block explorer and responded, "From what we can tell the ETC network is operating normally."
Fewer than eight hours later, the ETC network began seeing things differently. It asked "all exchanges and mining pools [to] please allow a significantly higher confirmation time on withdrawals and deposits [+400]."
Shortly thereafter, without confirming the attack had indeed taken place, it retweeted a CoinNess article citing exclusive information from SlowMist that a private mining pool had seized 51 percent of the network's hashrate.
Bitfly says it has increased block confirmations on its Ethereum Classic mining pool due to the reorg attack. At 19:22 UTC, Kraken announced it has increased confirmations for ETC deposits on its exchange from 120 to 500, meaning it will take nearly two hours for Classic transactions to be confirmed.