51% Attack

What is a 51% Attack, and how does it differ from the common assumption of "a hacker breaking in and stealing assets"?

When people hear "51% attack," the intuitive association is often a hacker cracking passwords and directly stealing money from other people's wallets — but that picture isn't accurate. A 51% attacker can't forge signatures, can't access wallets they don't hold the private keys to, and can't create new tokens out of thin air in violation of protocol rules — these are all cryptographic-layer protections that a 51% attack never touches.

What a 51% attack can actually do is manipulate the history of transactions the attacker was themselves a party to: once an attacker controls the majority of hash power or Staking weight, they can privately mine a parallel chain that excludes a transaction that already happened, and once this private chain's accumulated work (or validation weight) exceeds the public chain, broadcast it to replace the original one — a process called a chain reorganization, or reorg. If the attacker first deposits money at an exchange, converts it into another asset, or withdraws it, then uses this method to make the deposit record "disappear" from the chain, the same money has effectively been used twice — this is a double-spending attack.

Why can 51% attacks happen, and what structural problem does this risk reflect?

Most consensus mechanisms' security assumptions are fundamentally built on the economic logic that the cost of acquiring majority Block-production power is far higher than the benefit an attack could yield — Bitcoin is rarely considered a realistic 51% Attack target because assembling more than half the network's hash power requires hardware investment and electricity costs on the scale of billions of dollars, far exceeding any benefit a single attack could extract.

But this security assumption depends heavily on the premise that total network hash power or Staking volume is large enough. Once that premise doesn't hold — such as on a smaller, lower-market-cap chain — the cost of acquiring majority hash power or staking weight drops substantially, potentially achievable even by short-term renting cloud hash power, or temporarily borrowing hash power from a larger chain that shares the same mining algorithm (Ethereum Classic, for instance, still uses the mining algorithm Ethereum used before its Merge). Once the attack cost falls below what an attacker could gain through double-spending, a 51% attack becomes economically worthwhile — which is precisely why most real-world cases have concentrated on small and mid-sized chains.

How is a 51% Attack actually carried out, and what real historical cases exist?

A typical attack unfolds in a few steps: the attacker first deposits funds at an exchange or merchant, converting them into another asset or withdrawing directly; meanwhile, using the majority hash power or Staking weight they control, the attacker privately mines a parallel chain that excludes that deposit transaction. Once this private chain's accumulated work (or validation weight) exceeds the public chain, the attacker broadcasts it, and the network — following the longest-chain rule or the corresponding consensus rule — switches to this chain that doesn't include the deposit record. The original deposit record disappears from the chain, and the attacker has effectively obtained assets they already withdrew for free.

History offers several real cases: Bitcoin Gold suffered a 51% attack in May 2018, with attackers double-spending roughly $18 million; Ethereum Classic (which uses the same mining algorithm as pre-Merge Ethereum, meaning hash power could easily be temporarily rented from Ethereum to attack this much smaller chain) was attacked in January 2019 and again in August 2020 — the former double-spent roughly $1.1 million, the latter reorganized over 7,000 blocks and double-spent roughly $5.6 million; Vertcoin was attacked in December 2018, with roughly $100,000 double-spent. A more recent case occurred in August 2025, when a project called Qubic claimed to have obtained majority hash power on Monero and executed a six-Block chain reorganization; major exchanges immediately suspended deposits, and the Token's price fell more than 16% within a single week.

What does a 51% Attack mean for me, and what should I watch for?

If you hold or trade a PoW Token that's smaller in scale, lower in market cap, and shares a mining algorithm with a larger chain, the realistic risk of a 51% attack is substantially higher than holding a mainstream chain like Bitcoin or Ethereum — this is also why most exchanges set longer confirmation requirements for withdrawals of smaller PoW tokens than for mainstream coins, precisely to increase the time and cost an attacker would need to maintain a private chain's lead.

A more practical form of self-protection is: before confirming a transaction as a recipient (especially in the role of a merchant or exchange accepting high-value on-chain payments), verify whether that chain's total network hash power or Staking scale is large enough, whether it has experienced a real 51% attack before, and whether the confirmation count set by the exchange or platform for that chain is reasonable. It's also worth remembering that even a successful 51% attack can't let an attacker steal any of your other assets that weren't part of that specific transaction — meaning the actual victims of a 51% attack are typically exchanges or merchants who accepted the attacker's deposit and were then subject to a successful double-spend, rather than random ordinary holders.