What Is a 51% Attack? The Security Boundaries of Consensus

A 51% attack occurs when an attacker controls a majority of the hash power or a critical share of consensus weight and uses it to influence main-chain selection. The attacker may reorganize recent transactions, double-spend, or censor transactions, but cannot forge someone else's signature.

The term is most commonly used for PoW networks. PoS networks can also suffer majority-weight attacks, but the thresholds required to delay finality, control the chain head, or overturn history may differ. Not every attack can be reduced to an exact 51% threshold.

How Does a 51% Attack Happen on a PoW Network?

PoW nodes generally select the valid chain with the greatest cumulative work. If an attacker controls enough hash power, they can privately build an alternative branch and then try to make its cumulative work exceed that of the public chain.

A typical double-spend works as follows: the attacker first pays an asset on the public chain and receives goods or services from the counterparty. At the same time, the attacker creates a private branch that sends the same input back to themselves. If the private branch catches up and the network adopts it, the original payment may disappear from the main-chain history.

Whether the attack succeeds depends on the attacker's share of hash power, the attack duration, confirmation depth, and the randomness of block production. A larger share improves the chance of catching the public chain, but the attacker must still keep committing resources.

To learn how PoW compares cumulative work, first read Proof of Work.

What Can and Cannot an Attacker Do?

Controlling most of the consensus resources does not allow an attacker to bypass validity rules. Full nodes still reject invalid issuance, incorrect signatures, and blocks that violate the protocol. The attacker mainly controls the ordering and selection among valid candidate histories.

Why Do More Confirmations Reduce Double-Spend Risk?

After a transaction enters a block, every later block adds to the public chain's cumulative work. To create an alternative history from an earlier point, an attacker must redo more blocks while also catching an honest chain that continues to grow.

Confirmation count only reduces probability; it does not provide one universal security guarantee for every network. Existing confirmation policies may be insufficient when total network hash power falls suddenly, hash power can be rented for short periods, the target transaction is highly valuable, or mining pools are concentrated.

Trading platforms set different confirmation requirements according to network conditions and asset risk. They may suspend deposits and withdrawals during abnormal periods to prevent internal balances from being used or withdrawn before a chain reorganization reverses the corresponding transaction.

Can a 51% Attack Happen on PoS?

Yes, but the security thresholds in PoS depend on the specific protocol. On Ethereum, roughly one-third of the staked weight can affect finality, more than half can substantially control chain-head selection, and overturning finalized history involves a higher weight, slashing, and off-chain social coordination.

A PoS attacker may have staked assets destroyed and be forced to exit. Equipment used in a PoW attack may still exist after the attack, so the cost of repeating an attack differs between the two systems.

Therefore, "51% attack" can serve as a general term for majority control, but a PoS analysis should examine the fork-choice rule, finality thresholds, and slashing conditions directly.

How Can You Identify a Majority Attack or Deep Reorganization?

Common signs include different explorers reporting different chain heads, confirmed transactions returning to pending status, unusually deep block reorganizations, a sudden concentration of block-production power, and trading platforms increasing confirmation requirements or suspending deposits and withdrawals.

A delayed explorer alone does not prove that the network is under attack. Verification should compare multiple independent explorers, full-node data, block hashes, and official project status notices. This helps distinguish a consensus attack from an indexing failure or a wallet display error.

Ordinary users cannot eliminate chain-level reorganization risk by switching wallets. For high-value payments, they can wait for more confirmations and avoid immediately delivering irreversible off-chain goods or services while the network is behaving abnormally.

Network attacks are different from phishing, fake platforms, and other scams. See the Complete Guide to Cryptocurrency Scams for common fraud types, or return to the Consensus Mechanisms Guide to understand where consensus attacks fit into the broader protocol.

Frequently Asked Questions

Can a 51% Attacker Create an Unlimited Number of Tokens?

Usually not. Nodes still enforce issuance, signature, and transaction-validity rules. Unless the protocol itself contains another vulnerability, majority hash power cannot make a block that violates supply rules valid.

Is a Trading Platform Hack the Same as a 51% Attack on a Blockchain?

No. A platform hack generally involves accounts, private keys, or internal systems. A 51% attack targets a blockchain's consensus resources and main-chain selection.

Can Moving Assets to a New Address Avoid a Majority Attack?

It cannot eliminate the chain-level effect. If the block containing the transfer is reorganized out, the record at the new address may also be rolled back. Changing the address only changes where the assets are controlled; it does not change consensus security.

Why Is It Called 51%? Must the Attacker Control Exactly More Than Half?

The term 51% is a shorthand for majority control. A smaller share may still cause a short-term reorganization through luck, a network advantage, or a particular strategy, while different attack objectives in PoS have different thresholds.