Bitcoin Universe · Model 15
The Bitcoin security arena
Why rewriting history gets harder with every block. An attacker pays a shop, then races the whole honest network on a secret track to make that payment disappear. Choose how strong the attacker is and how long the shop waits.
The race
With half or more of all hash rate, an attacker that never gives up wins every race eventually (this one gives up 30 blocks behind, so near half a few races still fail). Even then it can only replace recent blocks with its own valid ones: it cannot create extra bitcoin, and it cannot spend coins it has no keys for.
The odds
Confirmations make reversal less and less likely. They never make it impossible while an attacker has any hash rate.
Compare: an attacker that never gives up Theoretical
Two different questions. This race is the chance that this attacker succeeds under the figure's rules: it starts its branch at the fork, mines privately while the shop waits for z confirmations, needs strictly more work, and gives up 30 blocks behind. Theoretical is the chance that an attacker who is d blocks behind right now ever draws level, if it never stops and its share q never changes: (q/p)d with p = 1 − q when q is below 50 %, and 1 at 50 % or more.
The theoretical figure is not the chance of a double spend after z confirmations: by then the attacker usually has blocks of its own, which the race above accounts for. Drawing level is not success either, because the attacker still needs strictly more work. At 50 % or more, "eventually" can mean a very long wait at real cost, with no guarantee of any gain. No share of hash rate lets anyone spend coins without valid signatures.
What hash rate cannot do
Send a block that breaks the rules through the validation gate. Every node checks every block, so it is rejected whatever share of hash rate made it.
Run many races
| Confirmations | Reorgs | Simulated rate | Exact for this race | Whitepaper §11 |
|---|
Assumptions. An isolated, seeded simulation, not the live network. Difficulty stays constant, so each block adds equal work. The attacker's share of hash rate is fixed and it starts mining in secret at the payment's parent block. It publishes as soon as its branch has strictly more work after the shop has its confirmations, and gives up 30 blocks behind. There is no network delay and no selfish mining. A successful attack only reverses the attacker's own payment; it cannot touch anyone else's coins. Time is accelerated and block intervals are random (exponential, ten-minute mean).