Live prices are currently unavailable — the exchange feed could not be reached and no recent cached reading is held.

Bitcoin Data GuideBitcoin Reference

Security & Resilience

51% attacks

A majority of hash power lets an attacker decide which valid chain the network builds on. It does not let the attacker create coins, spend coins it does not own, or change the rules that decide what a valid block is. The attack is real, but it is narrower than the name suggests, and the narrowness is a property of the design rather than a limitation of current hardware.

Protocol referenceSource: Bitcoin: A Peer-to-Peer Electronic Cash System, sections 6 and 11The incentive analysis and the catch-up probability model are both from the whitepaper.

What majority hash power means

Nodes follow the chain with the most accumulated proof of work. An attacker that controls more than half of the network's hash power can, on average, extend its own chain faster than the honest network extends the public one. That does not let it rewrite history from the genesis block; it lets it outrun the honest chain from some recent point forward, and only for as long as it keeps spending the hash power. The relevant quantity is not the share of hash power at a single moment but the work the attacker can sustain relative to the work the honest network produces while the attack is running.

The whitepaper's section 11 makes the arithmetic explicit. If the attacker's share is q and the honest share is p, the probability of catching up from z blocks behind is (q/p)^z when p exceeds q. At q = 0.1 the probability of catching up from six blocks is about 0.02%; at q = 0.3 it is above 4%; at q = 0.4 the paper's table requires 89 confirmations to bring the probability below 0.1%. The model shows both that a majority is powerful and that the power falls off quickly with depth.

The cost of acquiring that hash power is the subject of the security budget page. The point to carry forward is that the attack is an economic proposition, not a technical one: the attacker must outspend the honest network for as long as the attack lasts, and the honest network keeps producing blocks throughout.

What a majority cannot do

A majority miner cannot steal coins. To move an output, a transaction must carry a signature that satisfies the output's spending condition, and the attacker does not hold the private keys of the coins it wants to take. It can include a transaction that claims to spend those coins, but every node will check the signature and reject the block. The whitepaper states the limit plainly: an attacker "can only try to change one of his own transactions to take back money he recently spent."

A majority miner also cannot change the consensus rules. Rules are enforced by the software each node runs, and a node that sees a block breaking a rule it knows will reject it regardless of how much work the block carries. An attacker that produced blocks under a different rule set would be mining a chain that other nodes consider invalid, and the honest chain would continue without it. Changing a rule requires the operators of nodes to adopt software that enforces the change, which is a distributed decision among economic participants rather than a decision a mining majority can make.

A third limit is that the attack is not free to sustain. The attacker's hash power is not destroyed by the attack, but it is unavailable for honest mining while the attack runs, and the honest network continues to accumulate work. An attack that fails to overtake the honest chain leaves the attacker with the same hardware and a smaller share of the rewards it would otherwise have earned.

What a majority can do

The two capabilities that remain are censorship and the reversal of the attacker's own recent transactions. A majority miner can refuse to include a transaction, and can refuse to build on blocks that contain it, which can keep a transaction out of the chain for as long as the attack lasts. It can also mine a conflicting transaction that spends the same output as a payment it made, and publish the competing chain once it has more work, undoing the payment. This is the double spend described on the double spending page, and it is the attack a merchant's confirmation policy is designed to price.

Both capabilities are temporary and both are visible. A censorship attack ends when the attacker stops, and the censored transactions can then be mined. A reversal is detectable by anyone watching the chain, and the deeper the transaction was buried, the more work the reversal requires. Neither capability lets the attacker keep anything it did not already have a claim to.

Sources

Related reading