What Is a 51% Attack? Understanding Blockchain Security Risks

Ethereum Classic has suffered more than one real 51% attack, including incidents in 2019 and 2020 where attackers rewrote portions of its transaction history and double-spent coins. That kind of event happens when a single miner or a coordinated group gains control of more than half of a blockchain network’s mining power or staked tokens. With that much control, an attacker can rewrite recent transaction history and disrupt the very trust that makes a blockchain useful in the first place.

How a 51% Attack Works

Blockchains rely on consensus, a process where thousands of independent participants agree on which transactions are valid. In proof-of-work networks like Bitcoin, that agreement comes from miners competing to solve computational puzzles. In proof-of-stake networks, validators are chosen based on how many tokens they have locked up. Either way, whoever controls the majority of that mining power or staked value can effectively outvote everyone else.

With majority control, an attacker can prevent new transactions from confirming, reverse their own recent transactions to spend the same coins twice, and block other miners or validators from adding new blocks. What they cannot do is steal coins from other wallets, alter old transactions buried deep in the chain's history, or change the rules of the protocol itself.

Why It's Harder on Bigger Networks

The cost of a 51% attack scales with the size of the network. Attacking a blockchain with a small amount of total mining power or a small pool of staked tokens might only require renting some cloud computing capacity or acquiring a modest stake. Attacking Bitcoin or Ethereum is a different story entirely, since matching even a fraction of their total network power would require an enormous, and enormously expensive, amount of hardware or capital.

That cost calculus is one of the main reasons larger, more established networks are considered safer bets. Smaller altcoins with thin mining power or low staked value have historically been the most common targets, since the price of an attack can be far lower than the potential payoff from double-spending on an exchange.

Real-World Examples and Limits

Several smaller proof-of-work coins have suffered actual 51% attacks over the years, typically resulting in attackers double-spending coins on exchanges before the network could react. In most of these cases, the damage was limited to the specific window of time the attacker controlled, and exchanges and node operators can respond by requiring more confirmations before treating a deposit as final.

It's worth remembering that a 51% attack is a temporary loss of control, not a permanent takeover. Once an attacker's majority share drops back below half, or if the community respond with a fork, the network can generally recover, though the reputational damage can linger.

The Bottom Line

A 51% attack is less about someone taking over a blockchain forever and more about a temporary window where a majority holder can rewrite very recent history. The larger and more decentralized a network's mining or staking power, the more expensive and impractical that window becomes to open in the first place.