The 51% Attack Explained

A 51% attack is the canonical threat to a proof-of-work blockchain. It occurs when a single entity gains control of more than half of the network's mining power, giving it the ability to outpace the honest majority and reverse transactions that are only a few blocks deep. Despite the alarming name, the powers such an attacker gains are narrower than many assume. Understanding the 51% attack clarifies exactly what a blockchain's consensus does and does not guarantee.

What a 51% Attack Is

Proof-of-work chains follow the rule that the valid chain with the most accumulated work wins, a principle called Nakamoto consensus. Honest miners collectively build the longest chain because they hold most of the hash power. If one actor controls a majority of the hash rate, they can privately build blocks faster than everyone else combined and eventually present a longer chain that the network will adopt.

The threshold is often described as 51%, but any sustained majority suffices, and even somewhat less can enable probabilistic attacks. The equivalent in a proof-of-stake system is control of a majority of the staked value, though the economics differ sharply, as covered in proof of work versus proof of stake.

What an Attacker Can and Cannot Do

It is essential to be precise about the attacker's capabilities. A 51% majority can:

• Double-spend its own coins by reversing a transaction it already made.
• Exclude or censor transactions, refusing to include them in blocks.
• Reorganize newly mined blocks, orphaning honest blocks and the transactions they contain.

A 51% majority cannot:

• Steal coins from other users, because spending still requires a valid digital signature that only the owner's private key can produce.
• Create coins out of thin air or change the block reward, since nodes reject blocks that violate the protocol rules.
• Alter arbitrarily deep history, because rewriting old blocks requires redoing all the work stacked on top of them.

In short, the attack breaks the ordering and finality of newly confirmed transactions, not the cryptography that protects ownership.

How the Attack Works Step by Step

A double-spend via 51% attack typically unfolds like this:

1. The attacker sends coins to a victim, for instance depositing on an exchange, in a transaction included on the public chain.
2. In secret, the attacker mines an alternative chain that does not contain that transaction, instead spending the same coins elsewhere.
3. The attacker waits for the victim to accept the public-chain transaction as confirmed and release goods or funds.
4. Once the private chain is longer than the public one, the attacker broadcasts it.
5. Nodes switch to the heavier chain, the original transaction vanishes, and the coins are effectively returned to the attacker while they keep what the victim gave them.

Because the victim already treated the payment as final and parted with goods or another asset, the reversal is a genuine theft of value even though no private key was ever broken and no protocol rule was violated. The attacker simply rewrote which of two conflicting transactions the network considers real.

public chain:  ...-B-Tx(pay victim)-B-B           (honest, seen by victim)
secret chain:  ...-B-Tx(pay attacker)-B-B-B       (longer, released later)
result:  network switches to the longer secret chain and the payment is erased

Cost and Feasibility

The difficulty of a 51% attack scales with the honest network's total hash power. On the largest proof-of-work networks, acquiring a majority of the mining hardware and electricity is extraordinarily expensive, and doing so would risk destroying confidence in the very network the attacker hopes to exploit. Smaller chains are far more vulnerable, especially if their algorithm shares hardware with a larger chain, because an attacker can rent hash power from marketplaces and point it at the weaker network for a short, cheap burst.

Defenses

Networks and services mitigate the risk in several ways:

• Confirmation depth: waiting for more blocks before treating a transaction as settled makes reversal exponentially harder, since the attacker must outrun that many blocks.
• Higher total hash rate: a larger, more distributed mining base raises the absolute cost of a majority.
• Chain-selection safeguards and checkpointing: some clients resist deep reorganizations that would rewrite long-settled history.
• Proof-of-stake penalties: in staking systems, provably conflicting votes can be slashed, and finality gadgets make reverting finalized blocks cost a huge, unrecoverable amount of stake.

For the underlying consensus mechanics these defenses build on, see how blockchain works.

Key Takeaways

• A 51% attack gives an entity with majority hash power the ability to outpace the honest chain and rewrite shallow, newly mined blocks.
• Attackers can double-spend, censor, and reorganize low-confirmation transactions, but cannot steal coins, forge signatures, or mint new supply.
• The attack works by secretly mining a longer alternative chain that omits a transaction and releasing it after a payment is accepted.
• Large, well-distributed networks are costly to attack, while small chains with rentable hash power are far more exposed.
• Defenses include more confirmations, higher aggregate hash rate, checkpointing, and proof-of-stake slashing and finality.