<p>Generally, no, not until it's too late.</p>

<p>A typical 51% attack would look like this:</p>

<ol>
<li><p>Attacker privately starts mining their own chain, which diverges from the main chain at some block N.</p></li>
<li><p>Attacker deposits coins to your business, sending them from address A.  Call this transaction X.</p></li>
<li><p>Attacker inserts in his own chain a transaction X' which conflicts with X; typically X' sends the coins from address A to another address belonging to the attacker.</p></li>
<li><p>Attacker waits for several confirmations of transaction X, in blocks N+1, ..., N+6 (replace 6 with however many confirmations your business wants) of the main chain.</p></li>
<li><p>Once there have been enough confirmations to satisfy you, you deliver goods or services to attacker.</p></li>
<li><p>Attacker releases his own chain, which now has blocks up to, say, N+50.  Being longer, this chain is accepted by the network.  This chain doesn't contain the transaction X but instead X', so you don't have the coins you thought you did.</p></li>
</ol>

<p>Notice that up until Step 6, everything on the network looks completely normal; only the attacker knows what is going on.</p>

CC BY-SA 3.0
2015-03-26T08:34:46.550Z
After step 6, would everybody know the IP address of the attacker?
Alex Millar
CC BY-SA 3.0
2015-06-10T03:01:14.543Z
@AlexMillar Yes, unless he used a VPN.
Nick ODell
CC BY-SA 3.0
2015-06-10T05:04:02.800Z
@NickODell: I don't think *everyone* would know, with or without a VPN.  The attacker will expose his address (or that of his VPN, or Tor exit node) to all the other nodes to whom he sends his chain, but he could plausibly claim that he received it from someone else and was only relaying it.  Likewise, an innocent node who relays the blocks can't necessarily prove that they are not the attacker who generated those blocks.
Nate Eldredge
CC BY-SA 3.0
2014-05-05T16:32:17.977Z
2014-05-05T16:32:17.977Z
Nate Eldredge
<p>I am a developer building an application that accepts payments in cryptocurrencies.</p>

<p>Is it possible, in the occurence of a 51% attack, to build a script that detect this, so we can suspend withdrawals automatically?</p>

CC BY-SA 3.0
2015-06-09T22:44:59.400Z
potential duplicate: [Can a 51% attack be detected and dealt with?](http://bitcoin.stackexchange.com/q/1061/5406)
Murch
<security><majority-attack>
Can I detect a 51% attack as a developer
user15628
# Can I detect a 51% attack as a developer

(Asked by: username_0 on 2014-05-05)

I am a developer building an application that accepts payments in cryptocurrencies.

Is it possible, in the occurence of a 51% attack, to build a script that detect this, so we can suspend withdrawals automatically?

**Tags:** security, majority-attack

> **Comments:**
> **username_1**: potential duplicate: [Can a 51% attack be detected and dealt with?](http://bitcoin.stackexchange.com/q/1061/5406)  

---

## 1 answers

### Answer by username_2 on 2014-05-05. Score: 5

Generally, no, not until it's too late.

A typical 51% attack would look like this:

1. Attacker privately starts mining their own chain, which diverges from the main chain at some block N.
2. Attacker deposits coins to your business, sending them from address A. Call this transaction X.
3. Attacker inserts in his own chain a transaction X' which conflicts with X; typically X' sends the coins from address A to another address belonging to the attacker.
4. Attacker waits for several confirmations of transaction X, in blocks N+1, ..., N+6 (replace 6 with however many confirmations your business wants) of the main chain.
5. Once there have been enough confirmations to satisfy you, you deliver goods or services to attacker.
6. Attacker releases his own chain, which now has blocks up to, say, N+50. Being longer, this chain is accepted by the network. This chain doesn't contain the transaction X but instead X', so you don't have the coins you thought you did.

Notice that up until Step 6, everything on the network looks completely normal; only the attacker knows what is going on.

> **Comments:**
> **username_3**: After step 6, would everybody know the IP address of the attacker?  
> **username_4**: @username_3 Yes, unless he used a VPN.  
> **username_2**: @username_4: I don't think *everyone* would know, with or without a VPN.  The attacker will expose his address (or that of his VPN, or Tor exit node) to all the other nodes to whom he sends his chain, but he could plausibly claim that he received it from someone else and was only relaying it.  Likewise, an innocent node who relays the blocks can't necessarily prove that they are not the attacker who generated those blocks.  

---

