A customer sends me a payment for some digital good at my service, where delayed delivery is a deal-breaker, so I only wait for 1 confirmation by the network before releasing the links for the purchased digital item.

The prices of these itemsrange from 0,0001 XBT to 50 XBT.

I do realize that I should probably configure my service to wait for more confirmations for more expensive items, and taken that the current reward for the miners for a new block is 25 XBT would it be safe to assume that no hacker will have any incentive from performing an attack the new block (that contains the transactions that paid for the digital items from my store) when the sum of value of the total items I have sold that have 0-confirmed payments is smaller than 25 XBT?

Likewise, would 2 confirmations (total miner reward: 2 x 25 XBT) be considered as a safe threshold for items that cost 50 XBT?

  • This answer may be helpful.
    – user21147
    Commented Nov 17, 2014 at 3:21
  • Thanks @RickyDemer, however green addresses are more applicable in b2b scenarios, my service is pure b2c. Commented Nov 17, 2014 at 3:38
  • 1
    This paper: bitcoil.co.il/Doublespend.pdf might shed some light on your problem.
    – user11221
    Commented Nov 19, 2014 at 1:34

1 Answer 1


The thing to consider is, "what does the attacker have to give up in order to attack me?" If the cost of that thing is less than the reward from a successful attack, then attacking is rational from a purely economic standpoint. (Obviously, attacking someone comes with a non-economic moral cost.)

A miner who controls more than half of the network hash rate, and expects to maintain that control indefinitely, will lose nothing by attacking you. This is the so-called 51-percent attack.

A miner who controls less than half of the hash rate will likely lose a chance at a certain amount of income, but how much depends on how close they get to half of the network hash rate. I created the following image a few months ago to illustrate this:

Cost Of Attack In Forfeit Income

If you look at the BlockChain.info mining pools chart, you see there are several which can make affordable attacks against both once-confirmed and six-confirmed transactions. I suspect all that prevents them from doing so is their reputation in the community.

The others factor are:

  1. How much can the attacker get from you in a single attack? For example, can they order multiple 50 BTC items at the same time?

  2. How easily can the attacker profit from an attack against you? For example, how much can they resell those 50 BTC items for? Most attackers aren't going to want 20 digital copies of Plan 9 From Outer Space, but they'd love 20 times 50 BTC worth of another crypto currency.

Unfortunately, this factors don't apply just to you: they apply to everyone the attacker can attack at the same time. For example, if they can make 10 BTC by ripping you off and 190 BTC by ripping other people off, then an attack which costs less than 200 BTC is economically worth it. This means you can't fully analyze your risk by looking just at your items.

Waiting for more confirmations will always increase your security substantially, and I expect there are few things is this world worth 50 BTC that people can't wait an hour or two for them to arrive. (But hey, maybe I'm just not rich enough to be spending $20,000 USD on a regular basis.)

If this is all very depressing, I'm sorry. Long term, the goal of the community will be to decrease miner centralization. If no miner or mining pool controls more than about 1% of the network hash rate, attacks against once-confirmed transactions become both expensive and unpredictable, and attacks against six-confirmed transactions become practically impossible.

Footnote: Math

In the image above, the average cost of a successful attack here is

r * h * b / p(h,b) - r * (b-1)

Where r is the block reward (25 BTC), h is the percentage of network hash rate, b is the number of blocks to create (confirmations plus one), and p() is Satoshi's probability calculator from bitcoin.pdf page 7. r * h * b is the average value of work used per attempt; p(h,b) is the probability of success per attempt; r * (b-1) is the block reward the attacker would've received if they mined honestly.

For reference, the time (average number of blocks elapsed) an attack takes is simply

1 / p(h,b)
  • Great answer :) What does c stand for in the last formula? Commented Nov 17, 2014 at 2:03
  • So practically it doesn't cost a thing to a miner to perform such an attack if his hash power is greater than 10% of the total hashing power in the network? Commented Nov 17, 2014 at 2:08
  • 1
    @DougPeters Whoops c == b (c was for confirmations, but then I realized the formula was confirmations plus one, so I changed it to b for blocks). For one conf at 10%, p(0.10,2) == 0.050978, so the cost is 48.8 BTC. Cost doesn't actually equal 0 BTC until 50%, but the scale of the chart doesn't allow showing such "small" amounts. Commented Nov 17, 2014 at 2:51
  • Have you tried letting the cost axis be log-scale?
    – user21147
    Commented Nov 17, 2014 at 6:58
  • 2
    @DougPeters here's the code used to generate the plot. MIT license. Note, if I had to do it all over again, I'd use something besides bash & bc for the math. :-) Commented Nov 18, 2014 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.