Glossary / Privacy & security
51% attack
Also known as Majority attack, 51 percent attack.
- Definition
- A 51% attack is an attempt to rewrite recent bitcoin history by controlling most of the network's mining power, letting the attacker reverse their own recent payments.
Mining is a race, and whoever runs the most hardware wins the most races. A group holding more than half the hash rate can build a longer private chain and publish it, erasing blocks that other people already treated as final. It cannot forge your signature, so coins already sitting in a wallet you control are not what such an attack takes.
How it works
Bitcoin nodes follow the chain with the most accumulated proof of work, not the chain they happened to see first. An attacker exploits that rule by mining in secret. Starting from some recent block, they build their own branch without publishing it, while the rest of the network extends the public branch. If the secret branch ever gets longer, publishing it makes every node switch, and the blocks that lost the race are discarded along with the payments that only existed inside them.
The whitepaper measured exactly how hard that is. Section 11 solves for the number of confirmations needed to push the chance of a successful catch-up below 0.1 percent: 5 blocks against an attacker with 10 percent of the hash rate, 15 blocks at 25 percent, 24 blocks at 30 percent, and 340 blocks at 45 percent. The curve is steep, then it breaks. Above 50 percent the probability of eventually catching up is 1, and no number of confirmations fixes it. That discontinuity at half the hash rate is where the name comes from.
Majority hash power is not root access. A miner who mines an invalid block, one that pays itself 10 coins when the subsidy is 3.125 or spends an output it holds no key for, has that block rejected by every full node, including the cheap one running on a laptop. The attacker's powers are narrow and specific: exclude transactions from blocks, orphan blocks found by honest miners, and reverse payments it made itself within the last few blocks. It cannot mint coins outside the schedule, lift the 21 million cap, or move funds from an address it cannot sign for.
The attack is also rented, not built. Difficulty only recalculates every 2,016 blocks, so an attacker does not need to sustain anything for two weeks. On a chain whose algorithm has spare capacity in the mining market, a few hours of rented capacity is enough, which is why the victims have all been small chains rather than bitcoin.
Why this matters when you buy bitcoin
No successful majority attack has ever happened on bitcoin's main chain. The closest call was in July 2014, when the pool GHash.io drifted past half the network's hash rate and, under public pressure, published a commitment not to exceed 39.99 percent; the pool shut down in October 2016. Concentration is still the live worry. Two pools, Foundry USA and AntPool, between them build roughly half of all blocks, though the hash rate they direct is owned by thousands of separate miners who can repoint their machines at a different pool in minutes.
For a buyer, the practical exposure is narrow. Coins held in your own wallet cannot be reorganized away, because a reorg cannot change who holds the keys. What sits in the blast radius is value in motion: a deposit an exchange has credited but is still confirming, and any small proof-of-work altcoin listed next to bitcoin on the same platform. Of the 24 exchanges reviewed on this site, the ones that lost customer money lost it to custodial failure and fraud, not to chain reorganizations. That ratio has held for the whole history of the asset.
Confirmation waits are the visible cost of this defence. When an exchange makes you wait for several blocks before your deposit is tradable, it is buying itself the safety margin the whitepaper describes. If you are moving coins between platforms, plan for that delay rather than treating it as a bug.
Bitcoin Gold, attacked twice
Bitcoin Gold is the clearest worked example, because it is a 2017 fork of bitcoin's code that inherited everything except the hash rate. In May 2018 an attacker deposited BTG at exchanges, traded it for other assets, withdrew, then reorganized the chain so the deposits never happened. Reported double spends came to roughly 18 million dollars. Bittrex, one of the exchanges left short, delisted BTG in September 2018 after the project declined to cover the loss.
It happened again on January 23, 2020, with two deep reorganizations that reverted about 1,900 and 5,267 BTG, executed with hash power rented on the open market. The lesson generalizes: the cost of attacking a chain tracks its hash rate, not its market capitalization or its branding. A coin can be worth hundreds of millions of dollars and still be reorganized for the price of a few hours of rented machines.
51% attack vs double spend
A 51% attack is a method; a double spend is usually the payoff. Almost every real double spend attempt in bitcoin's history involved no mining at all, just a replacement of an unconfirmed transaction in the mempool, which costs the attacker nothing but a higher fee. Majority hash power is what you need to undo a payment that has already been buried in blocks, and that is a completely different budget.
51% attack vs selfish mining
Selfish mining is a profit strategy, not a history rewrite. Eyal and Sirer showed in 2013 that a miner who withholds found blocks and releases them strategically can earn more than its fair share of rewards with well under half the hash rate, in some network conditions from around a third. The selfish miner still respects consensus rules and never reverses a confirmed payment; it is stealing revenue from other miners, not coins from users.