Where is coinbase transaction after a hacker successfully performs >50% attack?

Question

Here is the scenario:

Honest nodes build one block from Block_1.

Hacker nodes privately build four blocks from Block_1 and broadcast these malicious blocks.

Now, where is the honest node's coinbase transaction (25 BTC + Transaction Fee). Is it included in the hacker's malicious blocks?

In Satoshi's white paper, he mentioned:

If a greedy attacker is able to assemble more CPU power than all the honest nodes, he would have to choose between using it to defraud people by stealing back his payments, or using it to generate new coins

I think a hack with more than 50% power could do BOTH, stealing back his payments and generate new coins. Why am I wrong?

Answer 1

You're not wrong.

A miner with more than 51% of the network's mining power can build the longest chain by himself, thus reaping all block rewards and dictating which transactions make it into the longest blockchain, allowing him to doublespend at will. Also see: What can an attacker with 51% of hash power do?

There can only be one valid block at each height, so when the attacker broadcasts his longer chain, it replaces the blocks of the honest node exclusively up to the common ancestor.
The mining reward from the honest blocks which are now not part of this longest chain will be treated as if they had never been found, as they do not represent valid blocks in the longest chain.

However, the malicious node's contrarian position will slow down the number of blocks found to a respective amount due to the reduced mining power supporting the longest chain (assuming he is trying to catch-up).

By playing selfishly, he will be in control short-term, still get only 51% of the rewards (at least until the difficulty reset), and shake the trust in Bitcoin, thus eroding the value of his bitcoins.

By playing cooperatively, he would gain 51% of the blocks and increase trust in the system, thus making his bitcoins more valuable.

Answer 2

Now where is the honest node's coinbase transaction (25 BTC + Transaction Fee). Is it included in the hacker's malicious blocks?

No, the honest node's coinbase transaction is included in its block. A coinbase transaction is always the first transaction inside a block.

I think by asking where is ... you are actually wondering about who will possess coinbase transaction!? If so, you should remember that the coinbase transaction/block reward will be paid to the miner of the block (including coinbase transaction) after this block is buried under 100 valid blocks ONLY if those 100 blocks end up in the main blockchain!

However, a block must have 100 confirmations before that reward can be spent, so we generate 101 blocks to get access to the coinbase transaction from block #1.

from Bitcoin Developer Examples