51% Attack on Blockchain: What It Is & How It Works

A 51% attack is a security threat where a single miner or group gains majority control of a blockchain's mining power or staked coins. With over half the network's resources, the attacker can manipulate transaction history and undermine trust. This guide explains how such attacks work, why they matter, and what protects blockchains against them.

What Exactly Is a 51% Attack?

In a blockchain that uses Proof of Work (PoW) , miners race to solve complex puzzles, and the network accepts the longest chain as the valid history. A 51% attack occurs when a participant or coalition controls more than half of the network's total hash rate (computing power). Similarly, for Proof of Stake (PoS) blockchains, an attacker would need to control over 50% of the staked coins.

With majority power, the attacker can:

• Create a private, longer chain that ignores recent honest blocks.
• Broadcast that private chain to the network, causing nodes to reorganize the blockchain and reverse transactions they had previously confirmed.
• Block new transactions from being confirmed (censorship), though this is temporary since honest miners can still work on their own chain.

The most famous consequence is a double spend — the same coins are sent to one recipient on the honest chain and then reused on the attacker's chain after the reorganization.

How Hash Rate Relates to Security

A blockchain's total hash rate is like the combined strength of 30 students arm‑wrestling a single opponent. If one student controls 16 of those arms, they can overpower the rest. For large blockchains such as Bitcoin, achieving 51% of the hash rate would require purchasing hundreds of thousands of specialized mining machines, making the attack prohibitively expensive. For smaller chains with low hash rate, renting cloud mining power for a few hours can be surprisingly cheap.

Real-World Examples of 51% Attacks

Several blockchains have suffered 51% attacks, demonstrating that the risk is real, especially for networks with limited mining participation.

• Bitcoin Gold (2018): An attacker gained majority hash rate by renting mining equipment. They performed a double spend against an exchange, reversing a deposit after it had been credited. The attack cost the perpetrator a relatively small fee for rented hash power, while the exchange lost a significant amount of cryptocurrency.
• Ethereum Classic (multiple times in 2020): The network experienced several deep reorganizations—chains rewound by thousands of blocks. Attackers exploited the chain's low hash rate relative to its larger cousin Ethereum PoW. These incidents led to exchanges increasing confirmation requirements and, in some cases, halting deposits temporarily.
• Verge (XVG) and Bitcoin SV: Both networks were hit by attacks that exploited software vulnerabilities alongside hash rate majority, resulting in billions of coins being created or manipulated.

These examples show that 51% attacks are not theoretical—they happen regularly on smaller proof-of-work blockchains.

What a 51% Attack Can and Cannot Do

Understanding the limits of an attack is as important as knowing its capabilities.

• Can do:
  • Reverse recent transactions (typically those within the depth of the attack chain, often the last 100–200 blocks)
  • Prevent new transactions from being confirmed (by ignoring honest blocks)
  • Reorder transactions to benefit the attacker's addresses
• Cannot do:
  • Create coins out of thin air — only existing transactions can be replayed or reversed
  • Alter transactions that occurred before the attack started — past history beyond the reorganization window is immutable
  • Steal private keys or funds from user wallets — the attacker cannot spend coins that were never sent to them, unless they revert a prior transaction

This distinction is crucial: a 51% attack is a form of network disruption, not a total collapse of cryptographic security.

Defenses Against a 51% Attack

Blockchain designers and exchanges use several strategies to mitigate the risk of a 51% attack.

Defense Mechanism	How It Works	Effectiveness
High hash rate / large stake	Attack becomes astronomically expensive; Bitcoin's hash rate makes a 51% attack economically irrational.	Very high for major networks
Confirmation thresholds	Exchanges wait for a set number of confirmations (e.g., 6 for Bitcoin) before accepting a deposit. A longer wait makes double spends harder.	Practical, but slows user experience
Checkpointing	Developers periodically finalize blocks using a trusted source, preventing reorganization beyond that point.	Effective but introduces centralization
Slashing (PoS)	Attackers who misbehave lose their staked coins, making an attack financially devastating for the perpetrator.	Strong deterrent in modern PoS chains
Monitoring and alerts	Nodes and miners can detect unusual reorganizations and warn the community to increase confirmations.	Reactive, but buys time

For Proof of Stake networks, a 51% attack requires owning the majority of staked coins—an action that would crash the coin's value, leaving the attacker with massive losses. This economic disincentive makes PoS potentially more resilient to the classic majority attack than PoW, though other attack vectors exist.

Conclusion

A 51% attack is a fundamental threat to blockchain security, but its practicality is limited by network size and defense mechanisms. For large, well‑established blockchains like Bitcoin or Ethereum (after its shift to Proof of Stake), such an attack remains highly improbable. However, smaller networks—especially proof-of-work chains with low hash rate—remain vulnerable. By understanding how 51% attacks work, you can better appreciate the trade-offs in blockchain design and the importance of waiting for multiple confirmations when receiving transactions.