Confirmation

Confirmations measure how expensive undoing a payment would be, not how long it has existed. Blocks arrive about every ten minutes on average, so six of them usually take around an hour. Exchanges turn the count into a credit rule, which is why a deposit can be visible on the chain and still unusable in your account.

How it works

Counting is simple arithmetic on block heights. Take the height of the chain tip, subtract the height of the block holding your transaction, add one, and that is your count. A transaction still waiting in mempools has zero, and the number climbs on its own as miners build on top.

The count is a cost estimate in disguise. Rewriting history means redoing the proof of work in your block plus every block above it, faster than the rest of the network is extending the honest chain. Section 11 of the bitcoin whitepaper works out the odds and solves for a failure probability under 0.1 percent: five blocks are enough against an attacker holding 10 percent of hash rate, twenty-four blocks against 30 percent, and 340 blocks against 45 percent. The familiar six is a rounded-up answer to a specific threat model, not a law.

Shallow reversals are real, though rare. In March 2013 a block that older software could not process split the network in two, and the branch carrying roughly 60 percent of hash power was deliberately abandoned when two large pools downgraded their nodes to restore a single chain. BIP50 is the post-mortem, and it records that exchanges suspended deposits while the split lasted and that one double spend was carried out during it. Races between miners who publish valid blocks moments apart are far more common and resolve within minutes.

The protocol states its own opinion in one place. A coinbase output cannot be spent until 100 blocks have been built on top of it, roughly 16 hours and 40 minutes, which is the network's built-in answer to how much depth makes newly created money safe to move.

Time between blocks is an average, not a schedule. Mining is a random search, so blocks can land seconds apart or leave an hour of silence, and the difficulty adjustment every 2,016 blocks is what pulls the long-run average back toward ten minutes.

Why this matters when you buy bitcoin

Deposit rules are set per platform, and you cannot trade what has not been credited. Kraken, Coinbase, and Binance each publish the number of confirmations they require before a bitcoin deposit becomes a tradable balance, and the wait is on top of however long your transaction spent in the mempool. Anyone planning to sell into a moving market should move coins to the venue before they intend to act, not during.

The same delay applies in reverse and catches people out at the worst moment. A withdrawal you request during a fee spike may sit unconfirmed for hours, which is one reason Strike and Kraken support Lightning payouts, where settlement is immediate and confirmations are not part of the flow.

Face-to-face and peer-to-peer trades are where the count does real work. On a marketplace such as Paxful the escrow protects the buyer, not you; if you are the one handing over cash, goods, or a bank transfer, do it after confirmations, not after seeing an identifier. Bitcoin ATMs make the opposite trade deliberately, dispensing on zero confirmations and pricing the risk into a spread that is often several percent.

Holding is the easy case. Coins already in your own wallet do not need watching, because depth only accumulates. Once a purchase from Bitpanda or Relai has landed and cleared a handful of blocks, no further action is ever required.

What six confirmations actually buys you

Take a 20,000 dollar purchase settling into your own wallet. At zero confirmations the payment lives only in mempools and can be replaced by the sender, because full replace-by-fee is the default relay policy in modern Bitcoin Core. At one confirmation it is in a block, and reversing it means an attacker out-mining the entire network from one block behind.

By six, the whitepaper's own numbers put the chance of a 10 percent attacker catching up at well under one in a thousand, and the cost of attempting it is the electricity and hardware to out-hash the world for an hour. For a personal savings transfer, one confirmation is already overwhelming. For a 20 million dollar settlement between institutions, six is the convention precisely because the attacker model is bigger.

The count also cannot be rushed. Fee bumping speeds up the first confirmation, since it moves you up the queue miners are sorting; nothing at all speeds up the second, because that block is going to take about ten minutes no matter who you are.

Confirmation vs block height

Block height counts blocks from the genesis block, so it only ever increases and is the same number for everyone. Confirmations are relative: they count the distance between one transaction and the current tip, so a payment gains confirmations continuously while its block height never changes. An explorer showing "block 900,000" and "412 confirmations" is telling you where the transaction sits and how buried it is.

Confirmation vs chain reorganization

Confirmations are the defense; a reorganization is the event they defend against. When two miners publish valid blocks at once, one branch is dropped and the transactions in it return to mempools, so a payment with one confirmation can briefly drop back to zero. This is normal network behavior rather than an attack, and it is exactly why depth matters: each additional block makes the branch containing your payment harder to abandon.