51% attack

A 51% attack happens when one miner, or a group working together, controls more than half of the network's hash power. The attacker uses that power to build a longer secret chain, and nodes switch to it. The attacker can then undo the transactions in the blocks it replaced. The name comes from the majority needed to do this reliably.

How does the attack work?

Nodes always follow the longest chain, which is the chain with the most work. Suppose an attacker pays a seller, and the seller hands over the goods. The attacker then builds a longer chain that leaves that payment out. Once the attacker publishes it, nodes reorganize onto it, and the payment disappears from the valid history.

The attacker's chain must also spend the same coins somewhere else, such as an address the attacker controls. Otherwise the original payment could be mined again on the new chain. Spending the same coins twice is called a double spend, and it is the goal of the attack. The chain reorganization page explains the switch that makes it work.

Why is it hard?

Honest miners keep extending the chain they follow. The attacker must add blocks faster than they do, and must also start from behind, at the block where the attack begins. An attacker with less than half the hash power can still get lucky. The odds fall quickly as the number of blocks grows.

Deep blocks are harder to replace than shallow ones. Every block added on top carries work that the attacker must match. The first hurdle is hardware, because a majority of the network's hash power is very expensive to buy and run.

How likely is an attack with less than half?

The Bitcoin white paper, in section 11, gives a formula for the chance that an attacker catches up from a number of blocks behind. Here q is the attacker's share of the hash power, and z is how many blocks behind the attacker starts.

import math

def attacker_success(q, z):
    p = 1 - q
    lam = z * (q / p)  # expected attacker blocks while honest miners add z blocks
    prob = 1.0
    for k in range(z + 1):
        poisson = math.exp(-lam) * lam ** k / math.factorial(k)
        prob -= poisson * (1 - (q / p) ** (z - k))
    return prob

print(round(attacker_success(0.4, 5), 4))  # 0.5506

To replace the top X blocks, the attacker must end with a chain one block longer than the honest one. So X blocks means z = X + 1. The table uses that rule.

Attacker's share of hash power	Replace the top 1 block	Replace the top 3 blocks	Replace the top 6 blocks	Replace the top 10 blocks
10%	5.1%	0.35%	0.0065%	0.00003%
20%	20.4%	5.3%	0.74%	0.056%
30%	44.6%	23.9%	9.9%	3.1%
40%	73.6%	60.3%	46.2%	33.2%
50% or more	100%	100%	100%	100%

Two things stand out. The chance falls fast as the depth grows. A 10% attacker has a 5.1% chance of replacing the top block, but less than 0.01% of replacing six. A miner with half the hash power wins with certainty in this model, which is why majority control matters so much.

Has anyone done it?

Not to bitcoin, as far as the public record shows. Some pools have come close to a majority. In 2014, the pool GHash.io came close to 50% of the network's hash power, and no attack followed. A majority makes an attack possible, but it does not make one likely. A large miner usually earns more from block rewards and fees than it could gain by rewriting one payment. An attack would also hurt the value of the coins it mines.

How do you estimate the hash power?

The target tells you how much work the whole network does, on average, per block. Here is the method at block 840,000, where the bits field is 0x17034219.

1. Convert bits to the target. Its mantissa is 0x034219 and its exponent is 0x17, so the target is 0x034219 times 256 to the power of 20.
2. Divide 2^256 by the target to get the expected hashes per block. That gives about 3.7 × 10^23 hashes.
3. Divide by 600 seconds, the average time between blocks. The network does about 6.2 × 10^20 hashes per second, which is roughly 618 exahashes per second.

To get majority control at that moment, a miner would need more than half of that figure. You can follow the difficulty and hash rate on our mining page.

Summary

A 51% attack needs most of the mining power and a plan to use it. Honest miners make it hard, and every new block makes it harder still for an attacker who starts behind. The longest-chain rule is what lets a longer chain win, which is why the attack depends on controlling most of the work.