<p>In theory, this attacker owns enough computing power that they could execute a "double spend" attack. They could spend coins in one place, allow the coins to enter the block chain as normal until the required confirmations are met, then fire up their 51% of the miners to craft a fraudulent fork of the block chain in which those coins were never spent, allowing them to re-spend the coins. This could theoretically be repeated for as long as the attacker maintained control of 51% or more of the hashrate.</p>

<p>Realistically, 51% is only the point at which this becomes <em>possible</em> not the point at which it becomes <em>likely</em> or <em>easy</em>. An attacker would probably need something like 65% to actually execute such an attack.</p>

CC BY-SA 4.0
2020-02-01T00:19:30.313Z
Well, the question actually specifies what damage can be done in *one week*.  It doesn't seem like any of the answers, including this one, have taken that into account.
Chan-Ho Suh
CC BY-SA 3.0
2011-09-06T18:24:34.003Z
Could you clarify if that 65% figure is a made up number of based on something?  I'm guessing there might be some curve that could plot the liklihood of succeeding vs. the percentage of the hashing power owned, but I don't know the details well enough to be sure...
Michael McGowan
CC BY-SA 3.0
2011-09-06T18:25:51.787Z
Will waiting for more confirmations decrease the chance of a successful double spend if an attacker consistently has 51% for a week?
ripper234
CC BY-SA 3.0
2011-09-06T18:38:01.713Z
The 65% is a made up number, little more than a semi-educated guess. If anyone has actual math to share I'd be happy to modify my answer to include it. As for waiting on confirmations, it will help but only so much. 51% or higher bestows some chance of forging a block on the attacker. If the attacker had 100% for a week they could undo a week's worth of blocks in that time. 51% would probably only let a thief undo a small handful of blocks if that much - again if anyone has the math to back this up, please post it.
David Perry
CC BY-SA 3.0
2011-09-06T21:29:36.260Z
51% would allow an attacker to undo as many blocks as they wanted and undo a transaction no matter how many confirmations it has. They simply commit the transaction they wish to undo into the public block chain and a conflicting transaction into their private block chain. They then wait until as many confirmations as needed. They then wait until their private block chain is longer than the public blockchain, which it will eventually be with higher and higher probability. As soon as their chain is longer, they announce it, and their chain wins.
David Schwartz
CC BY-SA 3.0
2011-09-06T18:19:06.830Z
2011-09-06T18:19:06.830Z
David Perry
<p>And then there is the denial of service possibility of suddenly withdrawing from the service, taking the necessary computing resources away to continue to solve blocks every ten minutes until the difficulty is adjusted down again (which could take a long time if there is only a block every day for example).</p>

<p>Of course, for that one would need much more than 51% of hash power. </p>

CC BY-SA 3.0
2011-09-08T02:49:22.087Z
if hashes are created every 10 minutes, and 51% leaves the network then hashes are created about every 20.4 minutes, so this answer is wrong (or assumes a lot more than 51% and thus doesn't answer the question)
Artem Kaznatcheev
CC BY-SA 3.0
2011-09-08T02:55:53.657Z
@Artem: Yes, I was trying to convey that in the last sentence. Sorry if that was unclear. I'll move the answer over to the question "What can an attacker with 95% of hash power do?" once it is asked ;-)
Thilo
CC BY-SA 3.0
2011-09-08T01:40:52.900Z
2011-09-08T01:40:52.900Z
Thilo
<p>Anyone who owns 51% of the network will have made a massive investment in hardware and systems to organize and construct a machine capable of executing such an attack. If their motive is profit, then the short term gain associated with forking the block chain to enable 'double spend' will net them a negligible benefit; it's difficult to imagine they would pursue this strategy on the basis that the resulting instability will ultimately de-value the very coins they seek to 'spend twice'. If their motive is to destroy Bitcoin, period, that is another matter altogether. That kind of <a href="http://www.yourwindow.to/information-security/gl_technovandalism.htm" rel="nofollow">techno-vandalism</a> could only reasonably be motivated by someone with destruction and disruption serving as their primary motivation.</p>

<p>Instead, I posit it's much more likely that such a massive and powerful compute resource (Bitcoin supercomputer) will be used to power the vast bulk of the network within the bounds of its intended use, profiting long term from generation rewards and transaction fees, as the network grows and prospers over time.</p>

CC BY-SA 3.0
2013-12-07T05:44:46.763Z
"will have made a massive investment in hardware and systems": based on this and following, you kind of imply that attacker would need to put massive amounts of, ahem, real-world money and resources into that. That doesn't have to be true: 1) attacker can use inflated value of pre-mined virtual currency; 2) fraudulent technical engineering (e.g. automatically built botnet); 3) social engineering, like inviting minority users to participate in "mining pools", essentially incentivizing users to willingly be put in adhoc botnets orchestrated by pool owner(s).
pfalcon
CC BY-SA 4.0
2023-02-05T15:06:54.207Z
Or someone could simply make an advance that the network wasn't expecting. A research scientist who discovers an innovative algorithm or a computer tech firm that makes an advance in quantum computing could rack up 51% of the solving power instantly.
Valorum
CC BY-SA 3.0
2011-09-16T03:14:45.637Z
2011-09-16T03:14:45.637Z
Andrew Jones
<p>The answers so far focus on the algorithm itself, I have a few social economic thoughts to add.</p>

<p>Let's assume Bitcoin is massively popular and indeed becomes THE global go-to currency, at this point this and similar questions become (very) relevant.</p>

<p>What happens in maturing industries is that through commoditization and mergers smaller and smaller numbers of players remain. Through scale advantages this small number of players will be able to provide services at lower cost and squeeze out smaller players. I see little reason the industry of Bitcoin transaction processing will be exempt from this general rule.</p>

<p>Next, we cannot foresee every aspect of the future, even though the Bitcoin designers did a terrific job there will be situations that will call for changes to the system. For example there might be a call from the people to stop child porn networks, to stop capital shelters for the rich, to stop overly profitable and powerful corporations,... etcetera, you name it. Whether justified or not, the people will demand for changes, not necessarily a villain government individual, the people. </p>

<p>Since there is only a small number of players it is actually possible to regulate the industry. For example the regulation could be that only payments with a traceable account number will be processed, or only payments with attached fees that include a portion for tax. </p>

<p>I would think the government could even demand changes to the core of the algorithm. Preventing, for example, "non-certified" players to enter, thereby further establishing the power of the existing payment processors.</p>

<p>The newly elected monopolists will then, in the final phase of capitalism self-destruction slowly but steadily raise their processing prices, eventually driving customers away and causing the Bitcoin to never reach the deflationary status many proponents and early investors claim it will have.</p>

<p>And let's just hope it ends this way, a forking scenario from this could be that the Bitcoin reaches "too big to fail" status, and the people demand further regulation (of processing fees, mining speed caps, etc). We will all keep paying a premium on the existence of the currency, just for the sake of stability and the fear for disruption of the status quo. Just like with today's currencies.</p>

<p>I'm not trying to be skeptical, I'm actually very hopeful the crypto currencies are going to help with globalization and advance humanity. As a deflationary currency to "easily" save for your (early) retirement I am not so sure. As a transaction system probably in some way.</p>

<p>Maybe we don't actually need a "currency" maybe all we need is a transaction. Maybe there can be a super layer on top of multiple competing crypto currencies that quickly and automatically switches your money back and forth between the best suitable mix of currencies and investment funds. After all what you really care about is how your salary is exchanged into goods and future promises. </p>

CC BY-SA 3.0
2015-12-19T00:19:52.010Z
Since the various governments would likely have differing interests, it seems unlikely that any one government could demand anything from the Bitcoin project.
Murch
CC BY-SA 3.0
2017-08-11T09:20:49.437Z
@Murch: given that miners are heavily located in few countries, a handful of governments could agree on hijacking a majority of hashpower, thus changing the rules as they see fit (eg. imposing part of the transaction fee to go into tax)
PPC
CC BY-SA 3.0
2017-08-11T20:00:15.900Z
Miner centralization is indeed a big concern, although they could only impose this on the companies in their jurisdiction and probably not on the network itself. Likely, the network would answer with a proof of work algorithm change if this turned into a major impediment for transaction traffic.
Murch
CC BY-SA 3.0
2015-12-18T19:18:34.750Z
2015-12-19T00:18:39.633Z
2015-12-19T00:18:39.633Z
Bastiaan
<p>A 51% percent attack would simply destroy the currency, and anyone holding a short position would make 100% profit. So there is a strong financial incentive for this attack and it has happened many times.</p>

CC BY-SA 4.0
2018-10-23T06:10:40.177Z
It has never been exploited on bitcoin.
Raghav Sood
CC BY-SA 4.0
2019-01-03T03:27:12.927Z
Why is this answer downvoted? It is absolutely true with the creation of BTC futures. To @RaghavSood, futures exchanges (major ones) have only been around about a year (not counting Bitmex). If the current futures exchanges had been around since bitcoin was born in 2009, then I'd bet for sure that the exploit will have been considered and probably even attempted.
nanonerd
CC BY-SA 4.0
2018-10-23T06:02:33.100Z
2018-10-23T06:02:33.100Z
user88816
<p>An attacker with 51% of the Bitcoin network's hash power, also known as a majority or 51% attack, can cause significant disruptions to the network. Here's what an attacker with 51% of the hash power can do, along with specific examples:</p>
<p>Double-spending: The attacker can spend the same coins multiple times by reversing their transactions. For example, they could purchase goods from an online store using Bitcoin and then reverse the transaction to get their Bitcoin back, effectively defrauding the store. This is done by creating a private fork of the blockchain and including their transactions in it, while simultaneously sending the same coins to another recipient on the main blockchain. With the majority of the hash power, the attacker can mine blocks faster and eventually make their private fork the longest chain, causing the network to accept it as valid.</p>
<p>Censorship: An attacker with 51% of the hash power can selectively exclude or delay specific transactions from being included in the blockchain. For instance, they could target a cryptocurrency exchange by preventing its withdrawal transactions from being confirmed, thereby disrupting the exchange's operations. By mining blocks without including certain transactions, they can prevent these transactions from being confirmed, potentially causing financial losses and reputational damage to the targeted parties.</p>
<p>Disrupt mining rewards: By controlling the majority of the hash power, the attacker can effectively monopolize mining rewards, leaving legitimate miners with fewer chances to mine blocks and earn rewards. For example, if the attacker mines 10 consecutive blocks, they would earn the block rewards for all 10 blocks while denying the rewards to honest miners. This could demotivate honest miners and potentially centralize mining power even further.</p>
<p>Perform a &quot;Goldfinger attack&quot;: An attacker with 51% control could use their power to destabilize the Bitcoin network and potentially profit from short-selling Bitcoin on exchanges. By executing a double-spending attack or causing significant delays in transaction confirmations, they could create fear and panic in the market, leading to a decrease in Bitcoin's value. The attacker would profit from the declining value by having previously placed short bets on Bitcoin.</p>
<p>Block reorganization: The attacker could use their hash power to perform &quot;block reorg&quot; attacks, where they mine a longer private chain and then broadcast it to the network. This would cause the network to accept the attacker's chain, orphaning previously mined blocks by honest miners. As a result, miners who thought they had earned block rewards would lose them, and any transactions within those orphaned blocks would be reversed.</p>
<p>Create transaction uncertainty: An attacker with 51% hash power could create uncertainty in the network by intentionally mining conflicting blocks or allowing double-spends, making it difficult for users and businesses to trust the validity of transactions. This uncertainty could lead to a loss of confidence in the Bitcoin network and negatively impact its adoption and value.</p>
<p>However, there are limitations to what an attacker with 51% of the hash power cannot do:</p>
<p>They cannot create new coins out of thin air beyond the mining reward specified by the Bitcoin protocol.</p>
<p>They cannot change the consensus rules, such as the 21 million Bitcoin supply cap or the mining reward schedule.</p>
<p>They cannot steal Bitcoin from users' wallets directly, as they do not have access to private keys.</p>

CC BY-SA 4.0
2023-04-27T14:05:27.703Z
2023-04-27T14:05:27.703Z
BBCD Satoshi
<p>I suspect he might be able to mine more than 51% of the blocks. See <a href="https://bitcoin.stackexchange.com/questions/1475/can-someone-with-51-computing-power-earn-more-than-he-deserves">Can someone with 51% computing power earn more than he deserves?</a></p>

CC BY-SA 3.0
2015-06-24T07:26:14.303Z
Right. If you mine more than half of the blocks, you can prevent anyone else from mining. Eventually, the difficulty will go down, and you'll be mining a block every ten minutes.
Nick ODell
CC BY-SA 3.0
2017-08-11T09:23:06.617Z
You should consider adding a quote of the link you're giving: link answers are annoying and poor quality
PPC
CC BY-SA 3.0
2011-10-11T08:01:09.563Z
2011-10-11T08:01:09.563Z
2017-04-13T12:47:36.707Z
ripper234
<p>Actually, it's very easy to do damage to the network once you have 51%; just build your own chain faster than the network, and broadcast it whenever you like. If you send some of your coins to a new address in your own chain, all the transactions issued in the live network by spending those same coins will be reversed at the moment the longer chain is broadcast.</p>

<p>Right from the <a href="https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power">bitcoin wiki</a> (probably proof-read by many pairs of eyes) :</p>

<blockquote>
  <p>An attacker that controls more than 50% of the network's computing
  power can, for the time that he is in control, exclude and modify the
  ordering of transactions. This allows him to:</p>
  
  <ul>
  <li>Reverse transactions that he sends while he's in control</li>
  <li>Prevent some or all transactions from gaining any confirmations</li>
  <li>Prevent some or all other generators from getting any generations </li>
  </ul>
  
  <p>The attacker can't:</p>
  
  <ul>
  <li>Reverse other people's transactions</li>
  <li>Prevent transactions from being sent at all (they'll show as 0/unconfirmed)</li>
  <li>Change the number of coins generated per block</li>
  <li>Create coins out of thin air</li>
  <li>Send coins that never belonged to him </li>
  </ul>
  
  <p>It's much more difficult to change historical blocks, and it becomes
  exponentially more difficult the further back you go. As above,
  changing historical blocks only allows you to exclude and change the
  ordering of transactions. It's impossible to change blocks created
  before the last checkpoint.</p>
  
  <p>Since this attack doesn't permit all that much power over the network,
  it is expected that no one will attempt it. A profit-seeking person
  will always gain more by just following the rules, and even someone
  trying to destroy the system will probably find other attacks more
  attractive. However, if this attack is successfully executed, it will
  be difficult or impossible to "untangle" the mess created — any
  changes the attacker makes might become permanent.</p>
</blockquote>

CC BY-SA 3.0
2013-11-12T07:30:44.950Z
from the documentation: The client accepts the 'longest' chain of blocks as valid. The 'length' of the entire block chain refers to the chain with the most combined difficulty, not the one with the most blocks. This prevents someone from forking the chain and creating a large number of low-difficulty blocks, and having it accepted by the network as 'longest'.
Ilya Saunkin
CC BY-SA 3.0
2013-11-12T08:59:01.777Z
Yes sure. Longer is meant in terms of proof-of-work.
Stéphane Gimenez
CC BY-SA 3.0
2017-08-29T15:47:02.827Z
A 51% attacker can steal coins from SegWit addresses.
MCCCS
CC BY-SA 4.0
2018-06-05T21:01:35.713Z
how would an attacker change an historic block ?
eran otzap
CC BY-SA 4.0
2018-06-13T03:19:12.320Z
@IlyaSaunkin, how would an attacker create a low-difficulty block? Wouldn't he still have to find the random nonce in every block in order to be approved by everyone once the fork is merged back?
Joe MB
CC BY-SA 4.0
2021-02-04T06:07:52.160Z
@JoeMB Two years late, but to answer your question for anyone who may stumble across this thread: miners try different nonces, hoping to find one which causes the numeric value of the block header's hash to be lower than a difficulty target. That difficulty target is dynamically adjusted based on network hashrate. You specify the target in the block header. Bitcoin nodes will reject blocks with artificially low difficulty to prevent cheating.
adrian
CC BY-SA 4.0
2021-12-19T12:34:06.263Z
how is that so? @MCCCS
John D
CC BY-SA 4.0
2021-12-19T15:39:36.163Z
@JohnD Soon after SegWit is activated but not much later miners can reverse the soft fork and spend the coins which are anyonecanspend outputs for legacy clients but safe segwit outputs for newer clients which would cause a chain split and if 51% wants to reverse SegWit, exchanges who haven't yet updated their clients would follow the chain with the highest accumulated PoW, in which miners could spend SegWit outputs to wherever they like. This is not possible if all clients and enterprises adopt SegWit at day 1 but since SegWit was designed as a soft fork an infeasible 51% attack by miners
MCCCS
CC BY-SA 4.0
2021-12-19T15:40:07.523Z
would continue harming legacy software until they go bankrupt. However since SegWit is more or less adopted everywhere today such an infeasible attack would have a small impact. It'd help to read about how SegWit works as a soft fork to understand what I described.
MCCCS
CC BY-SA 4.0
2022-01-06T08:21:36.133Z
> Since this attack doesn't permit all that much power over the network, it is expected that no one will attempt it.

 * * *

He he. The first "powers" listed would allow centralization of the protocol, so a state level agent can and will most likely try it if they find it interesting from a political point of view.

They'd basically turn Bitcoin into a regular state controlled currency.
oblio
CC BY-SA 3.0
2011-09-06T18:54:13.747Z
2011-09-06T19:17:38.640Z
2011-09-06T19:17:38.640Z
Stéphane Gimenez
<p>Suppose organization X has 51% of the hash power for a period of 1 week. In this week, what exactly can and can't X do?</p>

CC BY-SA 3.0
2014-12-16T19:59:10.343Z
Note that there may be some attacks, such as [selfish mining](http://arxiv.org/pdf/1311.0243v2.pdf), which require < 51%.
Chuck Batson
CC BY-SA 3.0
2016-05-31T08:56:29.027Z
I stumbled upon a short/funny video interview of Andreas Antonopoulos on the 51% Bitcoin Attack yesterday. This might interest you. https://www.youtube.com/watch?v=ncPyMUfNyVM
halpsb
<security><majority-attack>
What can an attacker with 51% of hash power do?
ripper234
# What can an attacker with 51% of hash power do?

(Asked by: username_0 on 2011-09-06)

Suppose organization X has 51% of the hash power for a period of 1 week. In this week, what exactly can and can't X do?

**Tags:** security, majority-attack

> **Comments:**
> **username_1**: Note that there may be some attacks, such as [selfish mining](http://arxiv.org/pdf/1311.0243v2.pdf), which require < 51%.  
> **username_2**: I stumbled upon a short/funny video interview of Andreas Antonopoulos on the 51% Bitcoin Attack yesterday. This might interest you. https://www.youtube.com/watch?v=ncPyMUfNyVM  

---

## 8 answers

### Answer by username_20 on 2011-09-06. Score: 104 | Accepted answer

Actually, it's very easy to do damage to the network once you have 51%; just build your own chain faster than the network, and broadcast it whenever you like. If you send some of your coins to a new address in your own chain, all the transactions issued in the live network by spending those same coins will be reversed at the moment the longer chain is broadcast.

Right from the [bitcoin wiki](https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power) (probably proof-read by many pairs of eyes) :

> An attacker that controls more than 50% of the network's computing
> power can, for the time that he is in control, exclude and modify the
> ordering of transactions. This allows him to:
>
> * Reverse transactions that he sends while he's in control
> * Prevent some or all transactions from gaining any confirmations
> * Prevent some or all other generators from getting any generations
>
> The attacker can't:
>
> * Reverse other people's transactions
> * Prevent transactions from being sent at all (they'll show as 0/unconfirmed)
> * Change the number of coins generated per block
> * Create coins out of thin air
> * Send coins that never belonged to him
>
> It's much more difficult to change historical blocks, and it becomes
> exponentially more difficult the further back you go. As above,
> changing historical blocks only allows you to exclude and change the
> ordering of transactions. It's impossible to change blocks created
> before the last checkpoint.
>
> Since this attack doesn't permit all that much power over the network,
> it is expected that no one will attempt it. A profit-seeking person
> will always gain more by just following the rules, and even someone
> trying to destroy the system will probably find other attacks more
> attractive. However, if this attack is successfully executed, it will
> be difficult or impossible to "untangle" the mess created — any
> changes the attacker makes might become permanent.

> **Comments:**
> **username_21**: from the documentation: The client accepts the 'longest' chain of blocks as valid. The 'length' of the entire block chain refers to the chain with the most combined difficulty, not the one with the most blocks. This prevents someone from forking the chain and creating a large number of low-difficulty blocks, and having it accepted by the network as 'longest'.  
> **username_20**: Yes sure. Longer is meant in terms of proof-of-work.  
> **username_22**: A 51% attacker can steal coins from SegWit addresses.  
> **username_23**: how would an attacker change an historic block ?  
> **username_24**: @username_21, how would an attacker create a low-difficulty block? Wouldn't he still have to find the random nonce in every block in order to be approved by everyone once the fork is merged back?  
> **username_25**: @username_24 Two years late, but to answer your question for anyone who may stumble across this thread: miners try different nonces, hoping to find one which causes the numeric value of the block header's hash to be lower than a difficulty target. That difficulty target is dynamically adjusted based on network hashrate. You specify the target in the block header. Bitcoin nodes will reject blocks with artificially low difficulty to prevent cheating.  
> **username_26**: how is that so? @username_22  
> **username_22**: @username_26 Soon after SegWit is activated but not much later miners can reverse the soft fork and spend the coins which are anyonecanspend outputs for legacy clients but safe segwit outputs for newer clients which would cause a chain split and if 51% wants to reverse SegWit, exchanges who haven't yet updated their clients would follow the chain with the highest accumulated PoW, in which miners could spend SegWit outputs to wherever they like. This is not possible if all clients and enterprises adopt SegWit at day 1 but since SegWit was designed as a soft fork an infeasible 51% attack by miners  
> **username_22**: would continue harming legacy software until they go bankrupt. However since SegWit is more or less adopted everywhere today such an infeasible attack would have a small impact. It'd help to read about how SegWit works as a soft fork to understand what I described.  
> **username_27**: > Since this attack doesn't permit all that much power over the network, it is expected that no one will attempt it.   * * *  He he. The first "powers" listed would allow centralization of the protocol, so a state level agent can and will most likely try it if they find it interesting from a political point of view.  They'd basically turn Bitcoin into a regular state controlled currency.  

---

### Answer by username_3 on 2011-09-06. Score: 35

In theory, this attacker owns enough computing power that they could execute a "double spend" attack. They could spend coins in one place, allow the coins to enter the block chain as normal until the required confirmations are met, then fire up their 51% of the miners to craft a fraudulent fork of the block chain in which those coins were never spent, allowing them to re-spend the coins. This could theoretically be repeated for as long as the attacker maintained control of 51% or more of the hashrate.

Realistically, 51% is only the point at which this becomes *possible* not the point at which it becomes *likely* or *easy*. An attacker would probably need something like 65% to actually execute such an attack.

> **Comments:**
> **username_5**: Could you clarify if that 65% figure is a made up number of based on something?  I'm guessing there might be some curve that could plot the liklihood of succeeding vs. the percentage of the hashing power owned, but I don't know the details well enough to be sure...  
> **username_0**: Will waiting for more confirmations decrease the chance of a successful double spend if an attacker consistently has 51% for a week?  
> **username_3**: The 65% is a made up number, little more than a semi-educated guess. If anyone has actual math to share I'd be happy to modify my answer to include it. As for waiting on confirmations, it will help but only so much. 51% or higher bestows some chance of forging a block on the attacker. If the attacker had 100% for a week they could undo a week's worth of blocks in that time. 51% would probably only let a thief undo a small handful of blocks if that much - again if anyone has the math to back this up, please post it.  
> **username_6**: 51% would allow an attacker to undo as many blocks as they wanted and undo a transaction no matter how many confirmations it has. They simply commit the transaction they wish to undo into the public block chain and a conflicting transaction into their private block chain. They then wait until as many confirmations as needed. They then wait until their private block chain is longer than the public blockchain, which it will eventually be with higher and higher probability. As soon as their chain is longer, they announce it, and their chain wins.  
> **username_4**: Well, the question actually specifies what damage can be done in *one week*.  It doesn't seem like any of the answers, including this one, have taken that into account.  

---

### Answer by username_7 on 2011-09-08. Score: 9

And then there is the denial of service possibility of suddenly withdrawing from the service, taking the necessary computing resources away to continue to solve blocks every ten minutes until the difficulty is adjusted down again (which could take a long time if there is only a block every day for example).

Of course, for that one would need much more than 51% of hash power.

> **Comments:**
> **username_8**: if hashes are created every 10 minutes, and 51% leaves the network then hashes are created about every 20.4 minutes, so this answer is wrong (or assumes a lot more than 51% and thus doesn't answer the question)  
> **username_7**: @username_8: Yes, I was trying to convey that in the last sentence. Sorry if that was unclear. I'll move the answer over to the question "What can an attacker with 95% of hash power do?" once it is asked ;-)  

---

### Answer by username_9 on 2011-09-16. Score: 4

Anyone who owns 51% of the network will have made a massive investment in hardware and systems to organize and construct a machine capable of executing such an attack. If their motive is profit, then the short term gain associated with forking the block chain to enable 'double spend' will net them a negligible benefit; it's difficult to imagine they would pursue this strategy on the basis that the resulting instability will ultimately de-value the very coins they seek to 'spend twice'. If their motive is to destroy Bitcoin, period, that is another matter altogether. That kind of [techno-vandalism](http://www.yourwindow.to/information-security/gl_technovandalism.htm) could only reasonably be motivated by someone with destruction and disruption serving as their primary motivation.

Instead, I posit it's much more likely that such a massive and powerful compute resource (Bitcoin supercomputer) will be used to power the vast bulk of the network within the bounds of its intended use, profiting long term from generation rewards and transaction fees, as the network grows and prospers over time.

> **Comments:**
> **username_10**: "will have made a massive investment in hardware and systems": based on this and following, you kind of imply that attacker would need to put massive amounts of, ahem, real-world money and resources into that. That doesn't have to be true: 1) attacker can use inflated value of pre-mined virtual currency; 2) fraudulent technical engineering (e.g. automatically built botnet); 3) social engineering, like inviting minority users to participate in "mining pools", essentially incentivizing users to willingly be put in adhoc botnets orchestrated by pool owner(s).  
> **username_11**: Or someone could simply make an advance that the network wasn't expecting. A research scientist who discovers an innovative algorithm or a computer tech firm that makes an advance in quantum computing could rack up 51% of the solving power instantly.  

---

### Answer by username_12 on 2015-12-18. Score: 4

The answers so far focus on the algorithm itself, I have a few social economic thoughts to add.

Let's assume Bitcoin is massively popular and indeed becomes THE global go-to currency, at this point this and similar questions become (very) relevant.

What happens in maturing industries is that through commoditization and mergers smaller and smaller numbers of players remain. Through scale advantages this small number of players will be able to provide services at lower cost and squeeze out smaller players. I see little reason the industry of Bitcoin transaction processing will be exempt from this general rule.

Next, we cannot foresee every aspect of the future, even though the Bitcoin designers did a terrific job there will be situations that will call for changes to the system. For example there might be a call from the people to stop child porn networks, to stop capital shelters for the rich, to stop overly profitable and powerful corporations,... etcetera, you name it. Whether justified or not, the people will demand for changes, not necessarily a villain government individual, the people.

Since there is only a small number of players it is actually possible to regulate the industry. For example the regulation could be that only payments with a traceable account number will be processed, or only payments with attached fees that include a portion for tax.

I would think the government could even demand changes to the core of the algorithm. Preventing, for example, "non-certified" players to enter, thereby further establishing the power of the existing payment processors.

The newly elected monopolists will then, in the final phase of capitalism self-destruction slowly but steadily raise their processing prices, eventually driving customers away and causing the Bitcoin to never reach the deflationary status many proponents and early investors claim it will have.

And let's just hope it ends this way, a forking scenario from this could be that the Bitcoin reaches "too big to fail" status, and the people demand further regulation (of processing fees, mining speed caps, etc). We will all keep paying a premium on the existence of the currency, just for the sake of stability and the fear for disruption of the status quo. Just like with today's currencies.

I'm not trying to be skeptical, I'm actually very hopeful the crypto currencies are going to help with globalization and advance humanity. As a deflationary currency to "easily" save for your (early) retirement I am not so sure. As a transaction system probably in some way.

Maybe we don't actually need a "currency" maybe all we need is a transaction. Maybe there can be a super layer on top of multiple competing crypto currencies that quickly and automatically switches your money back and forth between the best suitable mix of currencies and investment funds. After all what you really care about is how your salary is exchanged into goods and future promises.

> **Comments:**
> **username_13**: Since the various governments would likely have differing interests, it seems unlikely that any one government could demand anything from the Bitcoin project.  
> **username_14**: @username_13: given that miners are heavily located in few countries, a handful of governments could agree on hijacking a majority of hashpower, thus changing the rules as they see fit (eg. imposing part of the transaction fee to go into tax)  
> **username_13**: Miner centralization is indeed a big concern, although they could only impose this on the companies in their jurisdiction and probably not on the network itself. Likely, the network would answer with a proof of work algorithm change if this turned into a major impediment for transaction traffic.  

---

### Answer by username_15 on 2018-10-23. Score: 0

A 51% percent attack would simply destroy the currency, and anyone holding a short position would make 100% profit. So there is a strong financial incentive for this attack and it has happened many times.

> **Comments:**
> **username_16**: It has never been exploited on bitcoin.  
> **username_17**: Why is this answer downvoted? It is absolutely true with the creation of BTC futures. To @username_16, futures exchanges (major ones) have only been around about a year (not counting Bitmex). If the current futures exchanges had been around since bitcoin was born in 2009, then I'd bet for sure that the exploit will have been considered and probably even attempted.  

---

### Answer by username_18 on 2023-04-27. Score: 0

An attacker with 51% of the Bitcoin network's hash power, also known as a majority or 51% attack, can cause significant disruptions to the network. Here's what an attacker with 51% of the hash power can do, along with specific examples:

Double-spending: The attacker can spend the same coins multiple times by reversing their transactions. For example, they could purchase goods from an online store using Bitcoin and then reverse the transaction to get their Bitcoin back, effectively defrauding the store. This is done by creating a private fork of the blockchain and including their transactions in it, while simultaneously sending the same coins to another recipient on the main blockchain. With the majority of the hash power, the attacker can mine blocks faster and eventually make their private fork the longest chain, causing the network to accept it as valid.

Censorship: An attacker with 51% of the hash power can selectively exclude or delay specific transactions from being included in the blockchain. For instance, they could target a cryptocurrency exchange by preventing its withdrawal transactions from being confirmed, thereby disrupting the exchange's operations. By mining blocks without including certain transactions, they can prevent these transactions from being confirmed, potentially causing financial losses and reputational damage to the targeted parties.

Disrupt mining rewards: By controlling the majority of the hash power, the attacker can effectively monopolize mining rewards, leaving legitimate miners with fewer chances to mine blocks and earn rewards. For example, if the attacker mines 10 consecutive blocks, they would earn the block rewards for all 10 blocks while denying the rewards to honest miners. This could demotivate honest miners and potentially centralize mining power even further.

Perform a "Goldfinger attack": An attacker with 51% control could use their power to destabilize the Bitcoin network and potentially profit from short-selling Bitcoin on exchanges. By executing a double-spending attack or causing significant delays in transaction confirmations, they could create fear and panic in the market, leading to a decrease in Bitcoin's value. The attacker would profit from the declining value by having previously placed short bets on Bitcoin.

Block reorganization: The attacker could use their hash power to perform "block reorg" attacks, where they mine a longer private chain and then broadcast it to the network. This would cause the network to accept the attacker's chain, orphaning previously mined blocks by honest miners. As a result, miners who thought they had earned block rewards would lose them, and any transactions within those orphaned blocks would be reversed.

Create transaction uncertainty: An attacker with 51% hash power could create uncertainty in the network by intentionally mining conflicting blocks or allowing double-spends, making it difficult for users and businesses to trust the validity of transactions. This uncertainty could lead to a loss of confidence in the Bitcoin network and negatively impact its adoption and value.

However, there are limitations to what an attacker with 51% of the hash power cannot do:

They cannot create new coins out of thin air beyond the mining reward specified by the Bitcoin protocol.

They cannot change the consensus rules, such as the 21 million Bitcoin supply cap or the mining reward schedule.

They cannot steal Bitcoin from users' wallets directly, as they do not have access to private keys.


---

### Answer by username_0 on 2011-10-11. Score: 0

I suspect he might be able to mine more than 51% of the blocks. See [Can someone with 51% computing power earn more than he deserves?](https://bitcoin.stackexchange.com/questions/1475/can-someone-with-51-computing-power-earn-more-than-he-deserves)

> **Comments:**
> **username_19**: Right. If you mine more than half of the blocks, you can prevent anyone else from mining. Eventually, the difficulty will go down, and you'll be mining a block every ten minutes.  
> **username_14**: You should consider adding a quote of the link you're giving: link answers are annoying and poor quality  

---

