51% attacks

Wonder

1. If an entity controls more than half the computational work, which transactions become mutable?
2. Why does holding the keys to coins remain safe even when the history of their transfer is reversed?
3. How do exchanges adjust their confirmation requirements when a chain’s hashrate becomes volatile?

Explore

1. Nakamoto consensus follows the valid chain with the most cumulative proof of work. An attacker controlling over fifty percent of the global hashpower can mine blocks faster than the rest of the network, allowing them to build a private chain that eventually overtakes the public one. When this longer chain is broadcast, nodes switch their allegiance to it because it contains more work. This mechanism enables the reversal of recent transactions and the exclusion of others from the ledger.
2. The primary economic threat is the double-spend. An attacker sends coins to a merchant or counterparty, waits for one confirmation on the public chain, then reveals their hidden parallel chain where those same coins were spent elsewhere. Because the hidden chain now has more blocks, it becomes the canonical history. The original payment vanishes from the valid ledger. This attack is profitable only if the value of goods received exceeds the cost of electricity and hardware required to outpace honest miners.
3. Crucially, a majority attacker cannot steal coins belonging to others. Ownership in Bitcoin is cryptographic, not consensus-based. To spend someone else’s satoshis, an attacker would need their private keys, which are protected by secp256k1 elliptic curve cryptography. Mining power dictates the order of transactions and the validity of blocks, but it does not grant access to other users’ funds. An attacker can orphan honest miners’ blocks or censor specific transactions, but they cannot create money beyond the fixed emission schedule or change the underlying consensus rules.
4. Smaller proof-of-work networks face this threat with acute frequency due to lower total hashrates. Rented mining hardware makes majority control accessible for short periods. Bitcoin Gold suffered a successful attack in May 2018, where an attacker reversed transactions worth millions of dollars by controlling the network’s hashpower temporarily. Ethereum Classic experienced similar attacks in January 2019 and multiple times in August 2020. In each case, exchanges responded by requiring many more confirmations before crediting deposits.
5. Bitcoin itself has never suffered a successful majority attack. However, in June 2014 GHash.io briefly exceeded half of the network’s hashrate, causing alarm; a month later it pledged to stay below 40%. The economic cost of attacking Bitcoin is prohibitive because the attacker must sustain high electricity costs while competing with efficient global miners. An attacker would also need to hold that majority long enough to finish, and a failed attempt leaves only the cost.
6. The distinction between consensus control and cryptographic ownership defines the security model. Consensus protects the ordering of events—who paid whom and when—while cryptography protects the assignment of value—who owns what. A 51% attacker can manipulate the former but remains bound by the latter. This separation ensures that even in a worst-case scenario where history is rewritten, individual wallet security remains intact unless keys are compromised through independent means such as malware or social engineering.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• S. Nakamoto, 'Bitcoin: A Peer-to-Peer Electronic Cash System' (2008), Section 11
• E. Budish, 'The Economic Limits of Bitcoin and the Blockchain' (NBER Working Paper, 2018)
• Bitcoin Gold team statements on the May 2018 double-spend attack
• Public analyses of the Ethereum Classic 51% attacks (2019, 2020)