From 'Mastering bitcoin' -
checksum = SHA256(SHA256(prefix+data))
The 'data' is, for example, an address, which was calculated using SHA256 and then RIPEMD160. Why do we need double hashing when calculating the checksum?
Satoshi standardized on using double-SHA256 for 32-byte hashes, and SHA256+RIPEMD160 (each once) for 20-byte hashes, presumably because of (likely misguided) concern about certain attacks (like length extension attacks, which only apply when hashing secret data), and then used those everywhere:
To the best of my knowledge, none of these use cases actually benefit at all from double hashing.
Later additions at first copied this practice, presumably because the rationale wasn't that well understood, and continuing with the same approach was easiest to convince people was safe:
In more modern additions, it is no longer used:
In addition, various places where no cryptographically-sized hash is needed have been using other hash functions too:
Disclaimer: I'm a co-author of several proposals mentioned here, and may have forgotten other extensions.
Prevents some types of attacks.
Satoshi wanted to build something for the ages and was trying to prevent any and all attacks.
See here for details Why are hashes in the bitcoin protocol typically computed twice (double computed)?
Here's an answer from Zooko in 2011 that explains it is a convention used to "not have to think" about length extension attacks: https://crypto.stackexchange.com/questions/779/hashing-or-encrypting-twice-to-increase-security/884#884
My conjecture is the double hashing everywhere was a red-herring to make us think Satoshi was sloppy, lame and take our focus away from a posited valid use case for the
My lengthy and elaborate rationale is in my answer on the related question.