Bitcoin security budget

An attacker who wants to reverse a confirmed transaction must produce a competing chain with more accumulated work than the chain containing it. The cost of doing so is the cost of acquiring and running enough hash power to outpace the honest network for the duration of the attack, plus the opportunity cost of the rewards forgone while attacking rather than mining honestly. The security budget is the honest network's side of that comparison: it is what the honest miners are paid, and an attacker must exceed it to make progress.

The whitepaper's probability model makes the relationship concrete. An attacker with a fraction q of hash power catches up from z blocks behind with probability (q/p)^z when the honest share p exceeds q. The model assumes the attacker's share is fixed, which means it assumes the attacker has already acquired the hash power. The security budget is what determines how expensive that acquisition is, because hash power is paid for out of the same rewards the honest miners receive. A larger budget supports more hash power, and more hash power raises the cost of acquiring a majority.

The budget also constrains the attack in a second way. An attacker that acquires a majority must keep spending to hold it, because the honest network continues to produce blocks and the attacker's share erodes if it stops. The attack is a flow of expenditure, not a stock of hardware, and the budget is the rate the attacker has to beat.

The subsidy is scheduled to fall to zero. Each halving reduces it, and once the last halving has passed the only payment a miner receives is the fees of the transactions it includes. If the total budget is to remain large enough to support the hash power the network relies on, fees must eventually take over the role the subsidy plays today. Whether they will, and at what level of transaction demand, is an open question rather than a settled one, and it is the reason the composition of the budget is discussed separately from its size.

The two components behave differently. The subsidy is fixed by the protocol and predictable decades in advance. Fees are determined by demand for block space and vary with congestion, with the fee rate rising when more transactions compete for the same blocks. A budget composed mostly of subsidy is stable and insensitive to demand; a budget composed mostly of fees is responsive to demand and can fall sharply when demand does. Neither composition is inherently better, but they carry different risks, and the transition between them is the part of the schedule that is least certain.

A further consideration is that fees are paid by users who choose to transact, while the subsidy is paid by all holders through dilution of the supply. A network that funds its security through fees places the cost on the transactions that use the block space; a network that funds it through the subsidy spreads the cost across everyone holding the coin. The shift from one to the other changes who pays for security, not only how much is paid.

The miner revenue page covers the historical split between subsidy and fees, and the issuance and inflation page describes the schedule that produces the subsidy.