<p>The figure of 6 blocks is completely arbitrary. It is based on the assumptions that the attacker will not amass more than 10% of the network hashrate, and that a negligible chance of 0.1% for successfully double-spending is acceptable.</p>

<p>A more detailed analysis of this is available at <a href="https://bitcoil.co.il/Doublespend.pdf">Analysis of Hashrate-Based Double-Spending</a></p>

CC BY-SA 3.0
2013-11-05T15:16:10.963Z
2013-11-05T15:16:10.963Z
Meni Rosenfeld
<p>I believe this is addressed in page 8 of Satoshi's <a href="http://bitcoin.org/bitcoin.pdf" rel="noreferrer">Bitcoin paper</a> when showing the probability of an attacker catching up.</p>

<p>The <a href="https://en.bitcoin.it/wiki/FAQ#Why_do_I_have_to_wait_10_minutes_before_I_can_spend_money_I_received.3F" rel="noreferrer">wiki</a> states: </p>

<blockquote>
  <p>"Only 6 blocks or 1 hour is enough to make reversal computationally impractical."  </p>
</blockquote>

<p>The key word is "impractical".  </p>

<p>The important sentence in Satoshi's paper is: </p>

<blockquote>
  <p>"Assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a <a href="http://en.wikipedia.org/wiki/Poisson_distribution" rel="noreferrer">Poisson distribution</a>".  </p>
</blockquote>

<p>So, it is not that someone couldn't create the worlds first and own a $50 million ASIC farm, so as to have the ability to overtake the blockchain from a fork six blocks prior but that doing so would be a.) a massive undertaking, b.) obvious to all and c.) terrifically unprofitable to the attacker.</p>

CC BY-SA 3.0
2013-07-13T01:53:28.470Z
should I assume that David is correct rather than Meni since he's received more votes?
Griffin
CC BY-SA 3.0
2013-11-05T15:17:04.953Z
@Griffin: Have a look at https://bitcoil.co.il/Doublespend.pdf and judge for yourself.
Meni Rosenfeld
CC BY-SA 3.0
2011-09-20T22:38:36.870Z
It's also noteworthy that it's largely understood to be "6 blocks or 1 hour" **whichever is greater**. One of the big misconceptions we've spent a long time fighting (especially in the case of alternate blockchains) is the idea that faster confirmations change anything. A network with a one-minute block time would require 60 confirmations to be considered secure, not 6.
David Perry
CC BY-SA 3.0
2011-09-21T06:46:21.690Z
That helps some, but it opens up another question. Why is it that 1 hour is expected to be enough to make reversal computationally impractical?
osmosis
CC BY-SA 3.0
2011-09-21T16:09:20.270Z
There's a lot of math behind it, but in my (limited) understanding the key is the [Poisson Distribution](http://en.wikipedia.org/wiki/Poisson_distribution) bit. The chances of a modestly armed attacker getting "lucky" and successfully double-spending without having at least 51% of the network falls along such a distribution, and 60 minutes of computing time is the point at which it is adequately unlikely that a transaction may be undone (i.e. the point where the "long tail" of the distribution begins).
David Perry
CC BY-SA 3.0
2011-11-03T14:30:55.120Z
David, I'm afraid you're the one who has a misconception. The math parts which relate to the Poisson distribution and such talk about number of blocks, not time. 6 blocks is what guarantees that someone with, say, 10% of the hashrate, has a negligible chance to succeed double-spending. If each block is 1 minute then that's 6 minutes. The time (1 hour) only matters if we assume the attacker can't maintain his high hashrate for that long.
Meni Rosenfeld
CC BY-SA 3.0
2011-09-20T21:17:20.060Z
2016-01-22T18:57:30.137Z
2016-01-22T18:57:30.137Z
Stephen Gornick
<p>Many people misquote Satoshi paper and assume 6 is some hard value.</p>
<p>Satoshi's paper outlines the number of confirmations necessary to be 99.9% sure (less than 1 in 1000 chance of success) that an attacker couldn't build a longer chain to reverse the transaction.</p>
<p><a href="http://bitcoin.org/bitcoin.pdf" rel="noreferrer">http://bitcoin.org/bitcoin.pdf</a></p>
<pre><code>P &lt; 0.001
q=0.10   z=5
q=0.15   z=8
q=0.20   z=11
q=0.25   z=15
q=0.30   z=24
q=0.35   z=41
q=0.40   z=89
q=0.45   z=340
</code></pre>
<p>p is the chance of attacker eventually getting longer chain and reversing a transaction (0.1% in this case).
q is the % of the hashing power the attacker controls.
z is the number of blocks to put the risk of a reversal below p (0.1%).</p>
<p>So you can see if the attacker has a small % of the hashing power 6 blocks is sufficient.  Remember 10% of the network at the time of writing is ~100GH/s.  However if the attacker had greater % of hashing power it would take increasingly longer to be sure a transaction can't be reversed.</p>
<p>If the attacker had significantly more hashpower say 25% of the network it would require 15 confirmation to be sure (99.9% probability) that an attacker can't reverse it.</p>
<p>If the attacker has q of &gt;50% (&quot;the 51% attack&quot;) then given unlimited time the attacker will inevitably end up with the longest chain.</p>
<p>On edit: to clarify the &quot;unlimited time&quot; the chain with the higher hashrate will inevitably end up the longest however probability still comes into play.  We can not say with 100% certainty how long it will take at best we can provide a confidence interval.  If the attacker is just barely faster than the good miners (51% vs 49%) then it can take a very long time for an attacker to overcome a deficit of 6 blocks.  The more the attacker dominates (i.e. 70% vs 30%) the quicker the shorter the 95% confidence interval is reached.</p>

CC BY-SA 3.0
2012-10-16T22:36:10.337Z
If the attacker has a q >50%, he needs not unlimited time, but only enough time to produce more hashes than those contributed to the "honest" blockchain.
Streblo
CC BY-SA 3.0
2013-12-03T17:20:47.000Z
My point with unlimited time is that we don't know exactly how long it will take for an attacker to pull ahead.  Even with >50% of the hashpower the attacker is still affected by luck (good or bad).  The most that can be said is with a certain confidence interval.  i.e. "With 95% confidence, an attacker with x% of the hashrate will have the longest chain after y blocks".  At just above 50% hashrate the amount of time to have a 95% confidence is very long and even that isn't a guarantee.  The chain With >50% hashrate will inevitably end up the longest but the time required is probabilistic.
DeathAndTaxes
CC BY-SA 3.0
2013-12-23T16:08:41.120Z
It is basic probability, I would call it math more than a theory however one could observe it using a Monte Carlo simulation.
DeathAndTaxes
CC BY-SA 4.0
2011-11-04T00:54:46.767Z
2021-01-03T22:59:47.900Z
2021-01-03T22:59:47.900Z
DeathAndTaxes
<p>With more confirmations probability of making a successful double-spend decrease. While it is possible to perform a double-spend with less than 51% of hashing power it requires one to be luckier than the rest of the miners, ie. solve blocks faster than others. This will go on forever (to be correct: it is very unlikely) so the attacker will not be able to fork the whole chain. With pools until very recently controlling 30-40% of total hashing power the 6-confirmation rule would not have been safe if the pool operator had decided to commit a malignant act. </p>

CC BY-SA 3.0
2012-10-16T21:59:43.490Z
2012-10-16T21:59:43.490Z
Qba-th'Intrepid
<p>Here are some of the relevant sections from Satoshi's paper:
<a href="http://bitcoin.org/bitcoin.pdf" rel="noreferrer">http://bitcoin.org/bitcoin.pdf</a></p>

<p>"11. Calculations
We consider the scenario of an attacker trying to generate an alternate chain faster than the honest chain.  ... The race between the honest chain and an attacker chain can be characterized as a Binomial Random Walk.  The success event is the honest chain being extended by one block, increasing its lead by +1, and the failure event is the attacker's chain being extended by one block, reducing the gap by -1. ... The probability of an attacker catching up from a given deficit is analogous to a Gambler's Ruin problem. ...</p>

<p>p = probability an honest node finds the next block
q = probability the attacker finds the next block
qz = probability the attacker will ever catch up from z blocks behind</p>

<p><img src="https://i.sstatic.net/s1tlh.png" alt="equation"></p>

<p>Given our assumption that p > q, the probability drops exponentially as the number of blocks the attacker has to catch up with increases.  With the odds against him, if he doesn't make a lucky lunge forward early on, his chances become vanishingly small as he falls further behind ... the attacker's potential progress will be a Poisson distribution ... To get the probability the attacker could still catch up now, we multiply the Poisson density for each amount of progress he could have made by the probability he could catch up from that point.</p>

<p>Converting to C code..</p>

<pre><code>include &lt;math.h&gt;
double AttackerSuccessProbability(double q, int z)
{
    double p = 1.0 - q;
    double lambda = z * (q / p);
    double sum = 1.0;
    int i, k;
    for (k = 0; k &lt;= z; k++)
    {
        double poisson = exp(-lambda);
        for (i = 1; i &lt;= k; i++)
            poisson *= lambda / i;
        sum -= poisson * (1 - pow(q / p, z - k));
    }
    return sum;
}
</code></pre>

<p>Running some results, we can see the probability drop off exponentially with z.
"</p>

CC BY-SA 3.0
2011-09-21T20:41:56.680Z
Could you summarize the relevant part?
xyz
CC BY-SA 3.0
2011-09-23T03:35:22.420Z
The conclusion is that the probability of someone being able to generate blocks drops off exponentially. We know they can in fact do this if they have 51% of the network. So it seems that if someone had say 10% of the network, they could pull off a double spend sometimes with 0 confirms, and the odds of them getting 2 blocks, or 3, or more...drops off exponentially.  This is how I am interpreting this, I don't understand in detail the math he solves for. Im still not seeing any rational for 6 blocks, as opposed to 4 or 8. Perhaps there is non, and this was just a nice number that was picked.
osmosis
CC BY-SA 3.0
2011-11-03T20:22:58.800Z
With 30% and 6 blocks the probability of success is much higher than 1/2000, it's closer to 13% (I'm interpolating from Satoshi's results).
Meni Rosenfeld
CC BY-SA 3.0
2011-11-04T00:48:09.940Z
@MeniRosenfeld Crap your right.  I looked up wrong value.  I am deleting my prior comment because it is factually wrong.
DeathAndTaxes
CC BY-SA 3.0
2011-09-21T07:35:52.693Z
2012-02-02T18:41:42.530Z
2012-02-02T18:41:42.530Z
osmosis
<p>Why is 6 is the number of confirmations that is considered secure? I haven't found any mathematical explanation or otherwise that explains why it is 6 and not 5 or 7. Is there a historical reason for 6? Is there a specific way to calculate it so 6 is just a number that was chosen?</p>

<security><confirmations><mining-theory>
Why is 6 the number of confirms that is considered secure?
osmosis
# Why is 6 the number of confirms that is considered secure?

(Asked by: username_0 on 2011-09-20)

Why is 6 is the number of confirmations that is considered secure? I haven't found any mathematical explanation or otherwise that explains why it is 6 and not 5 or 7. Is there a historical reason for 6? Is there a specific way to calculate it so 6 is just a number that was chosen?

**Tags:** security, confirmations, mining-theory


---

## 5 answers

### Answer by username_0 on 2011-09-21. Score: 20 | Accepted answer

Here are some of the relevant sections from Satoshi's paper:
<http://bitcoin.org/bitcoin.pdf>

"11. Calculations
We consider the scenario of an attacker trying to generate an alternate chain faster than the honest chain. ... The race between the honest chain and an attacker chain can be characterized as a Binomial Random Walk. The success event is the honest chain being extended by one block, increasing its lead by +1, and the failure event is the attacker's chain being extended by one block, reducing the gap by -1. ... The probability of an attacker catching up from a given deficit is analogous to a Gambler's Ruin problem. ...

p = probability an honest node finds the next block
q = probability the attacker finds the next block
qz = probability the attacker will ever catch up from z blocks behind

![equation](https://i.sstatic.net/s1tlh.png)

Given our assumption that p > q, the probability drops exponentially as the number of blocks the attacker has to catch up with increases. With the odds against him, if he doesn't make a lucky lunge forward early on, his chances become vanishingly small as he falls further behind ... the attacker's potential progress will be a Poisson distribution ... To get the probability the attacker could still catch up now, we multiply the Poisson density for each amount of progress he could have made by the probability he could catch up from that point.

Converting to C code..

```
include <math.h>
double AttackerSuccessProbability(double q, int z)
{
    double p = 1.0 - q;
    double lambda = z * (q / p);
    double sum = 1.0;
    int i, k;
    for (k = 0; k <= z; k++)
    {
        double poisson = exp(-lambda);
        for (i = 1; i <= k; i++)
            poisson *= lambda / i;
        sum -= poisson * (1 - pow(q / p, z - k));
    }
    return sum;
}

```

Running some results, we can see the probability drop off exponentially with z.
"

> **Comments:**
> **username_8**: Could you summarize the relevant part?  
> **username_0**: The conclusion is that the probability of someone being able to generate blocks drops off exponentially. We know they can in fact do this if they have 51% of the network. So it seems that if someone had say 10% of the network, they could pull off a double spend sometimes with 0 confirms, and the odds of them getting 2 blocks, or 3, or more...drops off exponentially.  This is how I am interpreting this, I don't understand in detail the math he solves for. Im still not seeing any rational for 6 blocks, as opposed to 4 or 8. Perhaps there is non, and this was just a nice number that was picked.  
> **username_1**: With 30% and 6 blocks the probability of success is much higher than 1/2000, it's closer to 13% (I'm interpolating from Satoshi's results).  
> **username_5**: @username_1 Crap your right.  I looked up wrong value.  I am deleting my prior comment because it is factually wrong.  

---

### Answer by username_2 on 2011-09-20. Score: 72

I believe this is addressed in page 8 of Satoshi's [Bitcoin paper](http://bitcoin.org/bitcoin.pdf) when showing the probability of an attacker catching up.

The [wiki](https://en.bitcoin.it/wiki/FAQ#Why_do_I_have_to_wait_10_minutes_before_I_can_spend_money_I_received.3F) states:

> "Only 6 blocks or 1 hour is enough to make reversal computationally impractical."

The key word is "impractical".

The important sentence in Satoshi's paper is:

> "Assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a [Poisson distribution](http://en.wikipedia.org/wiki/Poisson_distribution)".

So, it is not that someone couldn't create the worlds first and own a $50 million ASIC farm, so as to have the ability to overtake the blockchain from a fork six blocks prior but that doing so would be a.) a massive undertaking, b.) obvious to all and c.) terrifically unprofitable to the attacker.

> **Comments:**
> **username_4**: It's also noteworthy that it's largely understood to be "6 blocks or 1 hour" **whichever is greater**. One of the big misconceptions we've spent a long time fighting (especially in the case of alternate blockchains) is the idea that faster confirmations change anything. A network with a one-minute block time would require 60 confirmations to be considered secure, not 6.  
> **username_0**: That helps some, but it opens up another question. Why is it that 1 hour is expected to be enough to make reversal computationally impractical?  
> **username_4**: There's a lot of math behind it, but in my (limited) understanding the key is the [Poisson Distribution](http://en.wikipedia.org/wiki/Poisson_distribution) bit. The chances of a modestly armed attacker getting "lucky" and successfully double-spending without having at least 51% of the network falls along such a distribution, and 60 minutes of computing time is the point at which it is adequately unlikely that a transaction may be undone (i.e. the point where the "long tail" of the distribution begins).  
> **username_1**: username_4, I'm afraid you're the one who has a misconception. The math parts which relate to the Poisson distribution and such talk about number of blocks, not time. 6 blocks is what guarantees that someone with, say, 10% of the hashrate, has a negligible chance to succeed double-spending. If each block is 1 minute then that's 6 minutes. The time (1 hour) only matters if we assume the attacker can't maintain his high hashrate for that long.  
> **username_3**: should I assume that username_4 is correct rather than username_1 since he's received more votes?  
> **username_1**: @username_3: Have a look at https://bitcoil.co.il/Doublespend.pdf and judge for yourself.  

---

### Answer by username_5 on 2011-11-04. Score: 47

Many people misquote Satoshi paper and assume 6 is some hard value.

Satoshi's paper outlines the number of confirmations necessary to be 99.9% sure (less than 1 in 1000 chance of success) that an attacker couldn't build a longer chain to reverse the transaction.

<http://bitcoin.org/bitcoin.pdf>

```
P < 0.001
q=0.10   z=5
q=0.15   z=8
q=0.20   z=11
q=0.25   z=15
q=0.30   z=24
q=0.35   z=41
q=0.40   z=89
q=0.45   z=340

```

p is the chance of attacker eventually getting longer chain and reversing a transaction (0.1% in this case).
q is the % of the hashing power the attacker controls.
z is the number of blocks to put the risk of a reversal below p (0.1%).

So you can see if the attacker has a small % of the hashing power 6 blocks is sufficient. Remember 10% of the network at the time of writing is ~100GH/s. However if the attacker had greater % of hashing power it would take increasingly longer to be sure a transaction can't be reversed.

If the attacker had significantly more hashpower say 25% of the network it would require 15 confirmation to be sure (99.9% probability) that an attacker can't reverse it.

If the attacker has q of >50% ("the 51% attack") then given unlimited time the attacker will inevitably end up with the longest chain.

On edit: to clarify the "unlimited time" the chain with the higher hashrate will inevitably end up the longest however probability still comes into play. We can not say with 100% certainty how long it will take at best we can provide a confidence interval. If the attacker is just barely faster than the good miners (51% vs 49%) then it can take a very long time for an attacker to overcome a deficit of 6 blocks. The more the attacker dominates (i.e. 70% vs 30%) the quicker the shorter the 95% confidence interval is reached.

> **Comments:**
> **username_6**: If the attacker has a q >50%, he needs not unlimited time, but only enough time to produce more hashes than those contributed to the "honest" blockchain.  
> **username_5**: My point with unlimited time is that we don't know exactly how long it will take for an attacker to pull ahead.  Even with >50% of the hashpower the attacker is still affected by luck (good or bad).  The most that can be said is with a certain confidence interval.  i.e. "With 95% confidence, an attacker with x% of the hashrate will have the longest chain after y blocks".  At just above 50% hashrate the amount of time to have a 95% confidence is very long and even that isn't a guarantee.  The chain With >50% hashrate will inevitably end up the longest but the time required is probabilistic.  
> **username_5**: It is basic probability, I would call it math more than a theory however one could observe it using a Monte Carlo simulation.  

---

### Answer by username_1 on 2013-11-05. Score: 11

The figure of 6 blocks is completely arbitrary. It is based on the assumptions that the attacker will not amass more than 10% of the network hashrate, and that a negligible chance of 0.1% for successfully double-spending is acceptable.

A more detailed analysis of this is available at [Analysis of Hashrate-Based Double-Spending](https://bitcoil.co.il/Doublespend.pdf)


---

### Answer by username_7 on 2012-10-16. Score: 1

With more confirmations probability of making a successful double-spend decrease. While it is possible to perform a double-spend with less than 51% of hashing power it requires one to be luckier than the rest of the miners, ie. solve blocks faster than others. This will go on forever (to be correct: it is very unlikely) so the attacker will not be able to fork the whole chain. With pools until very recently controlling 30-40% of total hashing power the 6-confirmation rule would not have been safe if the pool operator had decided to commit a malignant act.


---

