What a 51% attack can and cannot do to Bitcoin

A majority of hash power, not of coins, nodes or people

Bitcoin’s chain is extended by miners, who compete to find the next block by running enormous numbers of hashing calculations. Hash rate is the speed of that guessing across the whole network. Whoever finds a valid block first decides which transactions go in it, and the network follows the chain with the most accumulated work. So a miner with more than half of the hash rate will, over time, build a longer chain than everyone else combined. That is the whole basis of the attack, and it is why it is measured in hash power rather than in coins owned or nodes run. How mining works and what hash rate is each have their own article.

The white paper anticipated this in 2008. Its security argument is explicitly conditional: the system is secure “as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes.” Section 11 then asks what happens if that condition fails and an attacker generates an alternate chain faster than the honest one. The answer is narrower than most people expect.

What a majority can do: rewrite recent blocks and refuse to include transactions

Because the attacker can out-build the honest chain, they can mine a private branch and release it later to replace the public one. Any transaction in the replaced blocks that is not also in the attacker’s branch simply vanishes from history. That lets the attacker pay someone, wait for the payment to confirm, collect whatever was bought, then publish a branch in which the same coins were sent back to themselves instead. That is the double spend, and the Bitcoin Wiki notes that with more than half of the hash rate it succeeds with certainty, given enough time.

The wiki adds the uncomfortable corollary: no number of confirmations can prevent it, though waiting for more raises the attacker’s cost, because they must redo more blocks. A majority miner can also censor. By refusing to include certain transactions, and by orphaning blocks that other miners find, they can keep chosen payments off the chain for as long as they keep the majority. Both powers last only while the hash power lasts.

What it cannot do: steal coins, mint coins or change the rules

Here the white paper is unusually direct. Out-mining the network “does not throw the system open to arbitrary changes, such as creating value out of thin air or taking money that never belonged to the attacker.” Every node checks every block against the rules, and a block that spends coins without a valid signature, or pays a miner more than the schedule allows, is rejected by every honest node no matter how much work sits behind it. An attacker “can only try to change one of his own transactions to take back money he recently spent.”

Two economists at the Federal Reserve Bank of New York made the same point in November 2014: a majority miner could refuse to validate transactions or reverse their own, but “no one can add false transactions to the blockchain.” That is the job of nodes, not miners. It also means the supply cap is out of reach; a majority miner cannot award themselves extra coins, because the 21 million limit is enforced by every node that validates. Changing the rules themselves is a different thing entirely, covered in soft forks and hard forks.

A historical concentration episode: GHash.io in June 2014

In June 2014 a single mining pool, GHash.io, grew large enough to test the theory. Researchers writing at the Hacking, Distributed blog recorded it holding about 55 percent of the network’s hash rate for almost 24 hours, from 12 June to 13 June 2014, as CoinDesk reported the following month. A pool is not a single miner; it is thousands of miners pointing their machines at one coordinator, who could in principle direct all of that power. (See how pools work.) The cited pool statement denied participation in a majority attack; that is the operator’s statement, not an audit of every payment.

The pool’s operator, CEX.IO, put out a statement within days: “We never have and never will participate in any 51% attack or double spend against bitcoin.” By then the pool’s share had fallen to about 31 percent. It called for a round table of large pools and industry figures, which met in London on 9 July 2014. Out of that came a public pledge that GHash.io would keep its share under 39.99 percent of the network. CoinDesk’s Jon Matonis noted at the time that the pledge was “very unenforceable,” and that by 13 July the pool’s share had already fallen to about 34.6 percent as miners left.

The New York Fed economists framed why a pool in that position might not attack even if it could: a majority miner earns a large, steady income from block rewards, and an attack that visibly broke Bitcoin would collapse the value of the thing being mined. Their calculation was dated 2014 and the numbers have changed since, but the shape of the argument has not. Whether it still holds as the block subsidy halves is a question they raised themselves.

Where it has actually happened: smaller proof-of-work coins

On smaller coins the attack is not theoretical. In May 2018 Bitcoin Gold, a coin that had forked from Bitcoin, was hit by an attacker who gained majority hash power and double-spent deposits at exchanges, roughly $18 million worth by CoinDesk’s later accounting. Exchanges had been crediting deposits after five confirmations; afterwards they raised the requirement to 50. That spring CoinDesk listed Monacoin, Zencash, Verge and Litecoin Cash as also attacked, and pointed at the enabling condition: marketplaces such as NiceHash let anyone rent a large amount of hash power for a few hours.

Bitcoin Gold was hit again on 23 January 2020, twice in one day, with two chain reorganizations involving attempted double spends of about 1,900 and 5,267 BTG. The Bitcoin Gold team said it did not know whether the attacker successfully withdrew value from an exchange. James Lovejoy, a researcher at the MIT Digital Currency Initiative, traced the attacker’s mining address and estimated the rented hash power cost about 0.2 bitcoin per reorganization, roughly what the attacker earned back in block rewards. Ethereum Classic suffered worse in August 2020: a reorganization of more than 3,000 blocks that double-spent slightly over 800,000 ETC, worth about $5.6 million, using hash power that cost about 17.5 bitcoin, followed five days later by a second reorganization of more than 4,000 blocks. Its developers urged exchanges to “significantly raise confirmation times.”

The pattern is consistent. The attack works where hash rate is cheap to rent relative to what can be stolen, and the practical defense is to make the target wait longer than the attacker can afford. Bitcoin has a different hardware market and hash-rate scale; these smaller-chain incidents do not establish a reproducible present attack cost or a complete history of Bitcoin attacks.

Why “51 percent” is a simplification in both directions

Less than half can still work, sometimes. The white paper’s table shows an attacker with 30 percent of the hash rate has about a 4 percent chance of reversing a payment buried ten blocks deep, and the payment needs to be 24 blocks deep before the chance falls below 0.1 percent. That is why exchanges vary their confirmation requirements with the size of a deposit. Equally, more than half does not mean success is instant; the attacker still has to out-mine the honest chain from behind, and the deeper the target, the longer it takes.

The documented bugs and accidental splits that reorganized Bitcoin’s chain are catalogued in our consensus incidents dossier. They are worth reading next, because they show what recovery looks like when it is validity rules, not raw hash power, that decide which chain survives.