What if a miner tries to cheat?

Suppose a miner produces a block that pays itself more than the subsidy plus the fees of the transactions it included. The block's header may be perfectly well formed, its proof of work may meet the target, and it may arrive first at some nodes. It will still be rejected, because the coinbase transaction claims more value than the protocol allows. A node that accepted it would compute a different ledger from every other node, and its view of the chain would be ignored by the rest of the network. Rejecting the block is not a choice the node makes; it is the only way for the node to stay on the same chain as everyone else.

The same logic applies to a block that tries to spend someone else's coins. To move an output, a transaction must present a signature that satisfies the output's spending condition. A miner cannot forge that signature, because it does not hold the private key. It can include a transaction that claims to spend the output, but the signature check will fail and the block will be rejected. This is why the common claim that a majority miner can steal coins is wrong. It can reorder and censor, and it can attempt to reverse its own recent payments, but it cannot take coins it does not control.

A miner also cannot change the rules by fiat. Consensus rules are enforced by the software every node runs, not by a vote among miners. A miner that began producing blocks under a different rule set would be producing blocks that other nodes consider invalid, and those blocks would be discarded. Changing a rule requires the economic participants who run nodes to adopt software that enforces the new rule, which is a much slower and more distributed process than a mining majority.

The attacks that remain are the ones that stay inside the rules. A miner can censor transactions, refusing to include them and declining to build on blocks that contain them. A miner with enough hash power can attempt a double spend against its own transaction, which is the subject of the double spending page. A miner can also withhold a block it has found and release it later, a strategy known as selfish mining, which can waste the hash power of honest miners and marginally increase the withholding miner's share of rewards. These are real costs, and they are the reason the security budget matters: the cost of mounting them scales with the total hash power an attacker must outrun.

The practical conclusion is that the threat model is not "a miner breaks the rules." It is "a miner with a large share of hash power exercises the discretion the rules give it." That discretion is bounded, and the bounds are what make the system work without trusting any participant.