2

Let's say that the computational power from the genesis block to the current block becomes a trivial computation in the future by some supercomputer using a new technology exclusive to it. Perhaps this is a government funded secret project using a niche quantum computing algorithm or some other esoteric technology at the time that the rest of the world is oblivious to.

At this point, couldn't this supercomputer simply create a longer "fake" chain from the genesis block than the current Bitcoin blockchain, and broadcast this to all nodes as the valid chain to accept since it's the longest, thus invaliding all transaction since the genesis block?

1

1 Answer 1

3

Yes, it is a fundamental security assumption that the majority of the hashrate on the network is honest, where honest means "not collaborating to attack".

Assuming an antagonist with overwhelming hashrate appeared out of nowhere, this antagonist would be able to perform majority attacks at will against the Bitcoin network. The attacker could for example be able to censor transactions, prevent other miners from earning revenue, doublespend own funds by replacing already confirmed transactions, or drive up the difficulty and stop mining to slow down the network for everyone else. Replacing the whole blockchain from the genesis block would not be possible, because there are a few checkpoints protecting the first few years of the blockchain against changes. However, it would be possible to replace all blocks after last checkpoint at height 295 000. Either way, that would be more of a sledgehammer approach, which may be less attractive depending on the goals of the attacker.

Under the existing consensus rules, there is no effective defense against this, because the attacker could simply restart their attack at a different height if people rallied to reject the attacker blocks. The Bitcoin project would probably be considered failed, or devolve into some construct where the best chain is selected per social consensus, which could be argued to also be a failed state, but sounds plausible.

However, this sort of scenario is unlikely to come to pass. Bitcoin's proof-of-work is based on the SHA-256 hashing algorithm. Today, mining uses dedicated hardware, so called Application Specific Integrated Circuits or ASICs which have the hashing operations implemented directly on the silicon and can only perform SHA-256d hashes. Regular computing power is many magnitudes less performant and energy-efficient, so all supercomputers and general computers taken together wouldn't hold a candle against the existing hashrate on the Bitcoin network. Hashing is also quantum resistant, so this frequent boogieman also doesn't perturb us. This seems to leave the attacker only with the option to design their own designated hardware, get one or more silicon foundries to secretly produce it, and then to end up with enough chips to overwhelm the whole network. Such a massive majority attack would more likely than not fundamentally undermine trust in Bitcoin, tanking its value, at which point the attacker is sitting on hundreds of million dollars worth of very expensive paperweights.—It seems non-trivial to come up with these sort of funds just to essentially burn them or to make enough money off shorting Bitcoin to make such an attack worth it, beside the challenging logistics of pulling it off in the first place.

12
  • There's a major error of logic in the leap from "at which point their investment becomes worthless" to "The logistics and economics of such an attack sound prohibitive". One expects the value of an investment to be zero after cashing out, that is no proof that cashing out is unprofitable.
    – Ben Voigt
    Commented Feb 1, 2022 at 22:37
  • 1
    @BenVoigt: You're sitting on hundreds of millions worth of dedicated hardware built for the sole usecase that you just completely devalued. That's some really expensive paperweights.
    – Murch
    Commented Feb 1, 2022 at 23:41
  • Yes, but how much money did you squeeze out of the network in the process of subverting it?
    – Ben Voigt
    Commented Feb 1, 2022 at 23:46
  • My napkin math suggests that even when assuming all hashrate were produced by S19 Pros, the hardware cost producing sufficient hashrate for a majority attack would be more than $5 B, today. Not really my area of expertise, but that seems a bit much to recoup by shorting Bitcoin.
    – Murch
    Commented Feb 2, 2022 at 0:01
  • @Murch That assumes that you can close out the shorts while your attack holds. More likely, nobody moves any bitcoin until the mining algorithm is changed and the chain rolled back. There's no guarantee the price will be significantly lower at the point where you can again purchase bitcoin and settle the shorts. There may not be many sellers. Commented Feb 2, 2022 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.