<p><a href="https://bitcoin.stackexchange.com/questions/1975/would-any-of-the-the-current-botnets-be-able-to-launch-and-sustain-a-51-attack/1978#1978">DeathAndTaxes' answer</a> covers the main point:   </p>

<blockquote>
  <p>Botnets are composed of computers with a wide range of hardware
  (mostly medium/low end) and you need very specific high end hardware to
  efficiently mine bitcoins.</p>
</blockquote>

<p>I just want to add a few things about botnets. The largest botnets are estimated to have more than <a href="http://en.wikipedia.org/wiki/Botnet#Historical_list_of_botnets" rel="nofollow noreferrer">1 million computers</a>. So while the math makes an attack theoretically possible right now, in practice this is highly unlikely to happen. Here are a few reasons:</p>

<ul>
<li><p>Nodes are not constantly up. A botnet with millions of infected computers has a percentage of offline nodes because most people do not leave the computer up all the time</p></li>
<li><p>Sustaining a 51% attack with a botnet is hard because people would notice the increase in CPU/GPU activity and would most likely shutdown their computer and investigate the problem</p></li>
<li><p>Botnets work because people don't know that their computer is infected. Launching an attack like this would make people run anti-virus scans to find out what is causing the heat and the noise. A botnet owner can make thousands of dollars with stolen credit card data and DDoS attacks. They will not risk losing that just to launch an attack like this. It is not worth it.</p></li>
</ul>

CC BY-SA 3.0
2011-11-14T17:48:32.210Z
Your second bullet point - noticing activity isn't true. A smart attacker will simply keep the attack chain private.  There will no warning signs the attack is occuring.  Once attacker has a longer chain than the "legit" chain it will publish the chain at once.  Clients will see this new "Attack chain" as longer and replace the existing chain instantly.  The only warning will be after the fact when transactions simply go from confirmed to unconfirmed or invalid.
DeathAndTaxes
CC BY-SA 3.0
2011-11-15T02:17:33.053Z
@DeathAndTaxes My second and third points are very similar. An attacker mining a private chain would see the hashing power the botnet constantly dropping because people would notice the heat/noise and shutdown the computer. So even if you start with a 8Thash botnet, that number will decrease with time and a lot of nodes will "clean" themselves from the infection.
nmat
CC BY-SA 3.0
2012-06-18T06:25:49.313Z
@nmat If you do have enough zombies, each only needs to do a small little amount and it adds up to alot.
Pacerier
CC BY-SA 3.0
2011-11-13T05:26:33.717Z
2011-11-13T05:26:33.717Z
2017-04-13T12:47:36.647Z
nmat
<p>No.</p>

<p>The greatest element of security has come from the rise of specialized equipment.</p>

<p>Lets look at it in abstract form. If attackers and defenders have equivalent hardware then it becomes a numbers game.  To "block" 100K attackers would require 100K defenders.  Since botnets can be very large this is a dangerous dynamic.  If the defenders are 5x as powerful then it only takes 20K defenders to hold off 100K attackers.</p>

<p>High end GPU are relatively rare in computing world and even more rare among botnet victims.  A top of the line CPU can achieve 20MH/s while a top of the line GPU can achieve 800MH/s.  That isn't a 5x multiplier but a 40x multiplier.  Botnet nodes tend to be older systems with variety of CPU some far less capable than 20MH/s.  Even a few year old CPU is much less capable.  A Pentium IV for example only achieves 1 MH/s.  It takes 800x Pentiums IV CPU to achieve the same hashing power as a single HD 6990.</p>

<p>So specialization has given the Bitcoin network a huge advantage over attackers.  If we assume the average botnet CPU is capable of only 5 MH/s then to achieve 8TH/s of power would require 1.6 million botnet nodes.  The rise of FPGA in time will make the Bitcoin network even more efficient giving defenders an even larger advantage over the average botnet node.</p>

CC BY-SA 3.0
2011-11-13T02:56:43.807Z
2011-11-13T16:31:51.337Z
2011-11-13T16:31:51.337Z
DeathAndTaxes
<p>If you want to profit from Bitcoins, you would not want to work against it (as was explained by Satoshi in his original paper). A 51% attack would not bring you profit, rather it would make everyone involved in the project loose, as Bitcoin's reputation would be damaged.</p>

<p>The other thing is getting enough hashing power. Unless you target mining-specific machines, chances of getting higher-end mining-compatible graphics cards isn't too high. So the trojan would have to rely on getting a lot of moderately powered PCs, and in order to launch a 51% attack, the botnet would have to be quite big. <a href="http://www.darkreading.com/security/application-security/208808174/the-world-s-biggest-botnets.html" rel="nofollow">The biggest botnets</a>, consisting of over 100'000 computers could potentially accomplish this, but so far Bitcoin isn't a prime target for botnet activity.</p>

CC BY-SA 3.0
2011-11-13T02:50:27.997Z
One correction even 100,000 computers would be insufficient.  Most computers don't have OpenCL capable GPU.  CPU mining is rather weak with top of the line CPU pushing <20MH/s.  The average botnet node is often a 4 or 5 year old XP box which was lackluster when built and is unlikely to push 20MH/s.  Maybe 5MH/s.  So 100K nodes would "only" be 500GH/s.  At 5MH/s it would take ~1.6 million botnet nodes w/ average CPU to gain 51% control.  Of course a 8TH/s botnet could generate ~$21K a day by mining instead of attacking.
DeathAndTaxes
CC BY-SA 3.0
2011-11-13T11:44:28.660Z
Edited my answer to "potentially accomplish this".
ThePiachu
CC BY-SA 3.0
2011-11-12T14:29:18.093Z
2011-11-13T11:43:49.550Z
2011-11-13T11:43:49.550Z
ThePiachu
<p>The "owners" of botnets probably runs them as businesses, meaning that they will always seek profit-optimization. Do you believe that it is a matter of time before they will seek to launch and sustain a 51% attack on Bitcoins?</p>

<p>If one were to achieve a 51% attack, one would probably not get any significant amount of Bitcoins exchanged into ordinary currencies, before the value of Bitcoins would plummet. Also, I believe that at the moment, there are too few merchants that accept Bitcoins, so one would not be able to order anything of significant value before merchants would react to the fraud. Do you believe that the reason why botnets have not attacked Bitcoin, is that they would not have enough to gain, or is it because they do not have enough hashing power?</p>

<attack><majority-attack><botnets>
Would any of the current botnets be able to launch and sustain a 51% attack?
David
# Would any of the current botnets be able to launch and sustain a 51% attack?

(Asked by: username_0 on 2011-11-12)

The "owners" of botnets probably runs them as businesses, meaning that they will always seek profit-optimization. Do you believe that it is a matter of time before they will seek to launch and sustain a 51% attack on Bitcoins?

If one were to achieve a 51% attack, one would probably not get any significant amount of Bitcoins exchanged into ordinary currencies, before the value of Bitcoins would plummet. Also, I believe that at the moment, there are too few merchants that accept Bitcoins, so one would not be able to order anything of significant value before merchants would react to the fraud. Do you believe that the reason why botnets have not attacked Bitcoin, is that they would not have enough to gain, or is it because they do not have enough hashing power?

**Tags:** attack, majority-attack, botnets


---

## 3 answers

### Answer by username_4 on 2011-11-12. Score: 6 | Accepted answer

If you want to profit from Bitcoins, you would not want to work against it (as was explained by Satoshi in his original paper). A 51% attack would not bring you profit, rather it would make everyone involved in the project loose, as Bitcoin's reputation would be damaged.

The other thing is getting enough hashing power. Unless you target mining-specific machines, chances of getting higher-end mining-compatible graphics cards isn't too high. So the trojan would have to rely on getting a lot of moderately powered PCs, and in order to launch a 51% attack, the botnet would have to be quite big. [The biggest botnets](http://www.darkreading.com/security/application-security/208808174/the-world-s-biggest-botnets.html), consisting of over 100'000 computers could potentially accomplish this, but so far Bitcoin isn't a prime target for botnet activity.

> **Comments:**
> **username_2**: One correction even 100,000 computers would be insufficient.  Most computers don't have OpenCL capable GPU.  CPU mining is rather weak with top of the line CPU pushing <20MH/s.  The average botnet node is often a 4 or 5 year old XP box which was lackluster when built and is unlikely to push 20MH/s.  Maybe 5MH/s.  So 100K nodes would "only" be 500GH/s.  At 5MH/s it would take ~1.6 million botnet nodes w/ average CPU to gain 51% control.  Of course a 8TH/s botnet could generate ~$21K a day by mining instead of attacking.  
> **username_4**: Edited my answer to "potentially accomplish this".  

---

### Answer by username_1 on 2011-11-13. Score: 6

[username_2' answer](https://bitcoin.stackexchange.com/questions/1975/would-any-of-the-the-current-botnets-be-able-to-launch-and-sustain-a-51-attack/1978#1978) covers the main point:

> Botnets are composed of computers with a wide range of hardware
> (mostly medium/low end) and you need very specific high end hardware to
> efficiently mine bitcoins.

I just want to add a few things about botnets. The largest botnets are estimated to have more than [1 million computers](http://en.wikipedia.org/wiki/Botnet#Historical_list_of_botnets). So while the math makes an attack theoretically possible right now, in practice this is highly unlikely to happen. Here are a few reasons:

* Nodes are not constantly up. A botnet with millions of infected computers has a percentage of offline nodes because most people do not leave the computer up all the time
* Sustaining a 51% attack with a botnet is hard because people would notice the increase in CPU/GPU activity and would most likely shutdown their computer and investigate the problem
* Botnets work because people don't know that their computer is infected. Launching an attack like this would make people run anti-virus scans to find out what is causing the heat and the noise. A botnet owner can make thousands of dollars with stolen credit card data and DDoS attacks. They will not risk losing that just to launch an attack like this. It is not worth it.

> **Comments:**
> **username_2**: Your second bullet point - noticing activity isn't true. A smart attacker will simply keep the attack chain private.  There will no warning signs the attack is occuring.  Once attacker has a longer chain than the "legit" chain it will publish the chain at once.  Clients will see this new "Attack chain" as longer and replace the existing chain instantly.  The only warning will be after the fact when transactions simply go from confirmed to unconfirmed or invalid.  
> **username_1**: @username_2 My second and third points are very similar. An attacker mining a private chain would see the hashing power the botnet constantly dropping because people would notice the heat/noise and shutdown the computer. So even if you start with a 8Thash botnet, that number will decrease with time and a lot of nodes will "clean" themselves from the infection.  
> **username_3**: @username_1 If you do have enough zombies, each only needs to do a small little amount and it adds up to alot.  

---

### Answer by username_2 on 2011-11-13. Score: 4

No.

The greatest element of security has come from the rise of specialized equipment.

Lets look at it in abstract form. If attackers and defenders have equivalent hardware then it becomes a numbers game. To "block" 100K attackers would require 100K defenders. Since botnets can be very large this is a dangerous dynamic. If the defenders are 5x as powerful then it only takes 20K defenders to hold off 100K attackers.

High end GPU are relatively rare in computing world and even more rare among botnet victims. A top of the line CPU can achieve 20MH/s while a top of the line GPU can achieve 800MH/s. That isn't a 5x multiplier but a 40x multiplier. Botnet nodes tend to be older systems with variety of CPU some far less capable than 20MH/s. Even a few year old CPU is much less capable. A Pentium IV for example only achieves 1 MH/s. It takes 800x Pentiums IV CPU to achieve the same hashing power as a single HD 6990.

So specialization has given the Bitcoin network a huge advantage over attackers. If we assume the average botnet CPU is capable of only 5 MH/s then to achieve 8TH/s of power would require 1.6 million botnet nodes. The rise of FPGA in time will make the Bitcoin network even more efficient giving defenders an even larger advantage over the average botnet node.


---

