<p>Generally, all confirmations are relativistic: any chaintip could still be replaced with a heavier chain! However, reorganizations become increasingly costly and unlikely the more proof of work is piled on a block.</p>
<p>You are right, an attacker exerting a <a href="/questions/tagged/majority-attack" class="post-tag" title="show questions tagged &#39;majority-attack&#39;" rel="tag">majority-attack</a> can censor or rollback any transactions, and thus perform a <a href="/questions/tagged/doublespend-attack" class="post-tag" title="show questions tagged &#39;doublespend-attack&#39;" rel="tag">doublespend-attack</a> to return a payment they previously made to another party to themselves (also see <a href="https://bitcoin.stackexchange.com/q/658/5406">What can an attacker with 51% of hash power do?</a>).
If you are receiving payments that are orders of magnitudes larger than block rewards, you should consider additional precautions (e.g. KYC, collateral, waiting for more confirmations). The occurrence of a sustained majority attack on Bitcoin could be considered a fatal scenario for Bitcoin: no transaction could be trusted anymore at any number of confirmations.</p>
<p>You may have read that Bitcoin requires the majority of the hashrate to be &quot;honest&quot; to work. Honest in this context means &quot;not collaborating to attack the network&quot; or &quot;independently creating good-faith blocks&quot;. Fortunately, it is rather <a href="https://bitcoin.stackexchange.com/q/1093/5406">expensive to control the majority of the hashrate</a>. Each block reward is currently worth about $70,000, so a six block majority attack would likely cost $350,000+ in electricity cost alone. Additionally, it would require access to a majority of highly coveted and expensive hardware. Industrial Bitcoin miners have made enormous investments into application specific integrated circuits (ASICs), which can be used for nothing else than SHA-256d mining. The most likely way for a majority attack to come to pass on Bitcoin would be for someone to take over the mining controllers of multiple of the largest mining pools. I would hope that this would be discovered and remedied quickly.</p>
<p>That is not to say that your majority attack scenario hasn't come to pass before. Especially minority forks of larger networks, or other coins that use the same hashing algorithm than bigger networks have been majority attacked in the past. For example <a href="https://www.coindesk.com/attempted-51-attack-on-bitcoin-gold-was-thwarted-developers-say" rel="nofollow noreferrer">Bitcoin Gold was attacked with a 1,300 block reorganization in January 2020</a>.</p>

CC BY-SA 4.0
2020-09-27T12:42:58.960Z
I am so sorry , but still one thing is vague to me. I updated the answer. Could you take a look at it ? That's the most important thing I am trying to grasp. you will find UPDATED word in my question..
Nika Kurashvili
CC BY-SA 4.0
2020-10-08T22:54:47.333Z
Hi Murch, I'd appreciate it if you could take a look at those: 1) https://bitcoin.stackexchange.com/questions/99386/how-does-merkle-root-actualy-send-proof-to-light-node. 2)  https://bitcoin.stackexchange.com/questions/99385/how-transactions-work-in-bitcoin THANK YOU IN ADVANCE
Nika Kurashvili
CC BY-SA 4.0
2020-09-27T12:27:38.103Z
2020-09-27T12:42:58.473Z
2020-09-27T12:42:58.473Z
Murch
<p>I've read the following:</p>
<blockquote>
<p>transaction is “confirmed” once it is buried 6 blocks into the
blockchain. This is taken to be a sufficient proof of work such that
reversing 6 blocks to double spend coins in a specific transaction is
infeasible. As we mentioned</p>
</blockquote>
<p>Let's say Alice's blocks(honest node) is A-&gt;B-&gt;C and I included my transaction into that node which transforms 1BTC to starbucks to buy some coffee. (I am a malicious node), so my local chain is A-&gt;B-&gt;C' (note: It's C' and not C, and C' doesn't include my starbucks transaction, since i am trying to use 51% attack and double spend).</p>
<p>Now, Alice and other nodes do append blocks to their chain. Let's say A-&gt;B-&gt;C-&gt;D-&gt;E-&gt;F-&gt;G-&gt;H-&gt;I-&gt;J. That's great C block is already more than 6 deep into the blockchain. While Alice and others were building this chain, I am also building my chain(I have 51% hash rate power). and My local chain now looks like this A-&gt;B-&gt;C'-&gt;D'-&gt;E'-&gt;F'-&gt;G'-&gt;H'-&gt;I'-&gt;J' . Now, I solved one more and now after J', I also got K'...</p>
<p>If I now broadcast this, Alice is gonna accept this(longest) and I still double-spent it...</p>
<p>So, how does 6 confirmation really help at all? if someone has 51% power, 6 confirmation really doesn't matter. Any easy and good explanations about this?</p>
<p><strong>My observation and answer IMHO:</strong>  I think 6 confirmation doesn't solve double spend or 51% attack. It's for the situation when blocks get mined at the same time. If that's the case,it's possible that someone's transaction might get slashed since other longest chain will appear after blocks don't get mined anymore at any given point. So 6 confirmation means that blocks don't get mined at the same time for 6 times sequentially. Correct ?</p>
<p><strong>UPDATE:</strong> @murch This is what you're saying:</p>
<blockquote>
<p>Generally, requiring more confirmations before considering a
transaction reliable makes reorganization attacks more expensive</p>
</blockquote>
<p>And This is the only thing I don't understand.</p>
<p>If a malicious user has 51% attack power, why would more confirmations make it harder for him to attack ?</p>
<ul>
<li>HN(honest Node) - A-&gt;B-&gt;C</li>
<li>AN(Attacker Node) - A-B-C</li>
</ul>
<p>Attacker makes a transaction to HN (sending 5BTC to some merchant). but not in his own node, since it's local and doesn't broadcast. So we have the following:</p>
<ul>
<li>HN(honest Node) - A-&gt;B-&gt;C-&gt;D(includes 5btc transaction)</li>
<li>AN(Attacker Node) - A-B-C-&gt;D' (note D' , it's different from D - because it doesn't include the 5BTC transaction).</li>
</ul>
<p><strong>Scenario 1)</strong>  HN just mines nodes, and AN also mines nodes.  Let's say they mined E and E' respectively. Now the 5BTC transaction has the confirmation of 2 block. Attacker mined one more block F' and broadcasted it. HN will reorganize chain. and 5BTC is not in AN's chain anymore... So attack successfully happened.</p>
<p><strong>Scenario 2)</strong> While AN mines nodes, HN also mines nodes. attacker is faster, so AN mined 10 blocks starting at D'. HN mined 5 blocks starting at D. Now even though HN's D block has 6 confirmations, AN now broadcasts its longer chain and reorganization will happen on HN (removing D block, which consists of 5BTC transaction). so attack succeded.</p>
<p>So, we have 2 scenarios, one with 2 confirmations, one with 6 confirmations. How did 6 help at all in these cases, or at least cease the danger ?</p>

CC BY-SA 4.0
2020-09-27T11:55:20.587Z
related: https://bitcoin.stackexchange.com/q/658/5406, https://bitcoin.stackexchange.com/q/75884/5406, https://bitcoin.stackexchange.com/q/1093/5406
Murch
CC BY-SA 4.0
2020-09-27T12:02:37.117Z
I read those, but still doesn't help. If attacker and honest have the same chain (A->B->C) and now, someone made a transaction, so honest added it in D block (A->B->C->D), attacker didn't and attacker has (A->B->C->D'), now attacker will mine one more block faster and share it and honest node's D block which had a transaction of someone is still gone.
Nika Kurashvili
CC BY-SA 4.0
2020-09-27T12:03:47.037Z
Luckily, I'm already working on a fully fledged answer. :)
Murch
CC BY-SA 4.0
2020-09-27T12:44:33.610Z
Re your update: it's not harder, but it takes longer and is uneconomic. The attacker loses more money by creating the attacking chain than they gain by swindling the victim out of 5 BTC. Generally, if the attacker has a sustained majority of the mining power and starts using it maliciously, it's pretty much game over for Bitcoin.
Murch
CC BY-SA 4.0
2020-09-27T12:45:48.600Z
How does the attacker lose more money(except the electricity cost ? ) and i am sure electricity cost will be lower than 5BTC which he gets back.
Nika Kurashvili
CC BY-SA 4.0
2020-09-27T12:53:30.353Z
The mining power doesn't appear from thin air. Someone has to stop trying to mine honest blocks for revenue and instead try to reorganize the chaintip. If the attack succeeds they will make back the lost revenue in block rewards, but if it fails they get zilch. Additionally, a successful majority attack may damage the long term value of Bitcoin which is highly unattractive to miners who have made an enormous hardware investment that can only be used to mine bitcoins.
Murch
CC BY-SA 4.0
2020-09-27T12:53:32.387Z
Generally, the cost of mining tends towards the value of the mining reward: https://bitcoin.stackexchange.com/q/2154/5406. Each block's reward is currently about 6.5 BTC. To reorganize a n-block chaintip, someone is losing n block rewards. Unless the attacker can make this risk/loss worth the participating miner's costs, they are not going to have miners participating willingly.
Murch
CC BY-SA 4.0
2020-09-27T13:16:57.787Z
1) i guess by lost revenue you meant electricity + mining costs. 2) That still doesn't answer the question why 6confirmations are better than 2. if i am an attacker and i don't care about economy or loss, in this case,  it doesn't make any easier if bitcoin has 2 or 6 confirmations. right ?
Nika Kurashvili
CC BY-SA 4.0
2020-09-27T13:34:20.207Z
Maybe you need to clarify how the miner acquires the mining power in order to attack. Regardless, six block take roughly three times as long to discover as two blocks, so it gives other participants more time to react to the attack.
Murch
CC BY-SA 4.0
2020-09-27T13:38:07.470Z
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/113443/discussion-between-murch-and-nika-kurashvili).
Murch
<bitcoin-core><transactions><blockchain><bitcoind><nodes>
how does bitcoin's 6 confirmation really help?
Nika Kurashvili
# how does bitcoin's 6 confirmation really help?

(Asked by: username_0 on 2020-09-27)

I've read the following:

> transaction is “confirmed” once it is buried 6 blocks into the
> blockchain. This is taken to be a sufficient proof of work such that
> reversing 6 blocks to double spend coins in a specific transaction is
> infeasible. As we mentioned

Let's say Alice's blocks(honest node) is A->B->C and I included my transaction into that node which transforms 1BTC to starbucks to buy some coffee. (I am a malicious node), so my local chain is A->B->C' (note: It's C' and not C, and C' doesn't include my starbucks transaction, since i am trying to use 51% attack and double spend).

Now, Alice and other nodes do append blocks to their chain. Let's say A->B->C->D->E->F->G->H->I->J. That's great C block is already more than 6 deep into the blockchain. While Alice and others were building this chain, I am also building my chain(I have 51% hash rate power). and My local chain now looks like this A->B->C'->D'->E'->F'->G'->H'->I'->J' . Now, I solved one more and now after J', I also got K'...

If I now broadcast this, Alice is gonna accept this(longest) and I still double-spent it...

So, how does 6 confirmation really help at all? if someone has 51% power, 6 confirmation really doesn't matter. Any easy and good explanations about this?

**My observation and answer IMHO:** I think 6 confirmation doesn't solve double spend or 51% attack. It's for the situation when blocks get mined at the same time. If that's the case,it's possible that someone's transaction might get slashed since other longest chain will appear after blocks don't get mined anymore at any given point. So 6 confirmation means that blocks don't get mined at the same time for 6 times sequentially. Correct ?

**UPDATE:** @username_1 This is what you're saying:

> Generally, requiring more confirmations before considering a
> transaction reliable makes reorganization attacks more expensive

And This is the only thing I don't understand.

If a malicious user has 51% attack power, why would more confirmations make it harder for him to attack ?

* HN(honest Node) - A->B->C
* AN(Attacker Node) - A-B-C

Attacker makes a transaction to HN (sending 5BTC to some merchant). but not in his own node, since it's local and doesn't broadcast. So we have the following:

* HN(honest Node) - A->B->C->D(includes 5btc transaction)
* AN(Attacker Node) - A-B-C->D' (note D' , it's different from D - because it doesn't include the 5BTC transaction).

**Scenario 1)** HN just mines nodes, and AN also mines nodes. Let's say they mined E and E' respectively. Now the 5BTC transaction has the confirmation of 2 block. Attacker mined one more block F' and broadcasted it. HN will reorganize chain. and 5BTC is not in AN's chain anymore... So attack successfully happened.

**Scenario 2)** While AN mines nodes, HN also mines nodes. attacker is faster, so AN mined 10 blocks starting at D'. HN mined 5 blocks starting at D. Now even though HN's D block has 6 confirmations, AN now broadcasts its longer chain and reorganization will happen on HN (removing D block, which consists of 5BTC transaction). so attack succeded.

So, we have 2 scenarios, one with 2 confirmations, one with 6 confirmations. How did 6 help at all in these cases, or at least cease the danger ?

**Tags:** bitcoin-core, transactions, blockchain, bitcoind, nodes

> **Comments:**
> **username_1**: related: https://bitcoin.stackexchange.com/q/658/5406, https://bitcoin.stackexchange.com/q/75884/5406, https://bitcoin.stackexchange.com/q/1093/5406  
> **username_0**: I read those, but still doesn't help. If attacker and honest have the same chain (A->B->C) and now, someone made a transaction, so honest added it in D block (A->B->C->D), attacker didn't and attacker has (A->B->C->D'), now attacker will mine one more block faster and share it and honest node's D block which had a transaction of someone is still gone.  
> **username_1**: Luckily, I'm already working on a fully fledged answer. :)  
> **username_1**: Re your update: it's not harder, but it takes longer and is uneconomic. The attacker loses more money by creating the attacking chain than they gain by swindling the victim out of 5 BTC. Generally, if the attacker has a sustained majority of the mining power and starts using it maliciously, it's pretty much game over for Bitcoin.  
> **username_0**: How does the attacker lose more money(except the electricity cost ? ) and i am sure electricity cost will be lower than 5BTC which he gets back.  
> **username_1**: The mining power doesn't appear from thin air. Someone has to stop trying to mine honest blocks for revenue and instead try to reorganize the chaintip. If the attack succeeds they will make back the lost revenue in block rewards, but if it fails they get zilch. Additionally, a successful majority attack may damage the long term value of Bitcoin which is highly unattractive to miners who have made an enormous hardware investment that can only be used to mine bitcoins.  
> **username_1**: Generally, the cost of mining tends towards the value of the mining reward: https://bitcoin.stackexchange.com/q/2154/5406. Each block's reward is currently about 6.5 BTC. To reorganize a n-block chaintip, someone is losing n block rewards. Unless the attacker can make this risk/loss worth the participating miner's costs, they are not going to have miners participating willingly.  
> **username_0**: 1) i guess by lost revenue you meant electricity + mining costs. 2) That still doesn't answer the question why 6confirmations are better than 2. if i am an attacker and i don't care about economy or loss, in this case,  it doesn't make any easier if bitcoin has 2 or 6 confirmations. right ?  
> **username_1**: Maybe you need to clarify how the miner acquires the mining power in order to attack. Regardless, six block take roughly three times as long to discover as two blocks, so it gives other participants more time to react to the attack.  
> **username_1**: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/113443/discussion-between-username_1-and-username_0).  

---

## 1 answers

### Answer by username_1 on 2020-09-27. Score: 1 | Accepted answer

Generally, all confirmations are relativistic: any chaintip could still be replaced with a heavier chain! However, reorganizations become increasingly costly and unlikely the more proof of work is piled on a block.

You are right, an attacker exerting a [majority-attack](/questions/tagged/majority-attack "show questions tagged 'majority-attack'") can censor or rollback any transactions, and thus perform a [doublespend-attack](/questions/tagged/doublespend-attack "show questions tagged 'doublespend-attack'") to return a payment they previously made to another party to themselves (also see [What can an attacker with 51% of hash power do?](https://bitcoin.stackexchange.com/q/658/5406)).
If you are receiving payments that are orders of magnitudes larger than block rewards, you should consider additional precautions (e.g. KYC, collateral, waiting for more confirmations). The occurrence of a sustained majority attack on Bitcoin could be considered a fatal scenario for Bitcoin: no transaction could be trusted anymore at any number of confirmations.

You may have read that Bitcoin requires the majority of the hashrate to be "honest" to work. Honest in this context means "not collaborating to attack the network" or "independently creating good-faith blocks". Fortunately, it is rather [expensive to control the majority of the hashrate](https://bitcoin.stackexchange.com/q/1093/5406). Each block reward is currently worth about $70,000, so a six block majority attack would likely cost $350,000+ in electricity cost alone. Additionally, it would require access to a majority of highly coveted and expensive hardware. Industrial Bitcoin miners have made enormous investments into application specific integrated circuits (ASICs), which can be used for nothing else than SHA-256d mining. The most likely way for a majority attack to come to pass on Bitcoin would be for someone to take over the mining controllers of multiple of the largest mining pools. I would hope that this would be discovered and remedied quickly.

That is not to say that your majority attack scenario hasn't come to pass before. Especially minority forks of larger networks, or other coins that use the same hashing algorithm than bigger networks have been majority attacked in the past. For example [Bitcoin Gold was attacked with a 1,300 block reorganization in January 2020](https://www.coindesk.com/attempted-51-attack-on-bitcoin-gold-was-thwarted-developers-say).

> **Comments:**
> **username_0**: I am so sorry , but still one thing is vague to me. I updated the answer. Could you take a look at it ? That's the most important thing I am trying to grasp. you will find UPDATED word in my question..  
> **username_0**: Hi username_1, I'd appreciate it if you could take a look at those: 1) https://bitcoin.stackexchange.com/questions/99386/how-does-merkle-root-actualy-send-proof-to-light-node. 2)  https://bitcoin.stackexchange.com/questions/99385/how-transactions-work-in-bitcoin THANK YOU IN ADVANCE  

---

