The standard Bitcoin client normally needs to download the entire blockchain from the p2p network when first installed, but a shortcut is to provide it with a snapshot of the blockchain (at some point in time) in a file called bootstrap.dat. One can get this file from various sites and file sharing mechanisms such as BitTorrent.

My understanding is that the blocks taken from bootstrap.dat are not subjected to all the same checks as those downloaded from the p2p network (see this question). Therefore, an attacker might be able to get you to accept some invalid blocks by giving you a malicious bootstrap.dat. What, if anything, could they accomplish in this way?

For instance, if signatures are not verified for transactions coming from bootstrap.dat, the attacker might include a bogus transaction appearing to send a bunch of coins to one of their addresses. They could then convince you that they hold more coins than they actually do. But it's not clear how useful that would be; if they actually try to send you those nonexistent coins in payment for something, your client might believe the transaction is valid, but miners won't be fooled and the transaction will never confirm.

Are there other attacks I have not thought of?

1 Answer 1


You can fake an entire history of transactions and blocks perfectly, but unless you can get a majority of clients approved it's useless.

I'm not sure majority is defined as 51%, because there crypto is more complicated then that.

But look up how transactions get verified


So, basically it depends on the lower level procedures which decide which clients to confirm against and you'd need to get majority of those just to fool your client.

Because when an error is detected they all start communicating it

  • I don't think this answers my question. As far as I know, the steps described in the Wiki page on Transactions are not all done for transactions found in bootstrap.dat. Commented Dec 26, 2013 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.