Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.
Sign up to join this community
If an attacker were to gain 51% of the network, they can essentially forge arbitrary transactions double spend. But that would quickly lead to a completely loss of trust in bitcoin. In fact, that would probably happen as soon as someone was suspected of having a majority.
What strategies could a majority-attacker use to extract maximum value? What could they do without detection?
If an attacker were to gain 51% of the network, they can essentially forge arbitrary transactions.
With control over a majority of hash rate (either directly, or by using something like selfish mining to incentivize other miners to follow your policies), you can only forge arbitrary transactions for SPV clients.
For full nodes, you can only change your own confirmed payments, or (if you go more than 100 blocks back) eliminate any transactions from the chain which descend from recent coinbase (generation) transactions.
In fact, that [a completely loss of trust in Bitcoin] would probably happen as soon as someone was suspected of having a majority.
This contradicts history, as Ghash.io exceeded 51% in 2014. This was controversial, but did not seem to affect Bitcoin's exchange rate at the time nor did pool miners immediately leave the Ghash.io pool.
What strategies could a majority-attacker use to extract maximum value? What could they do without detection?
Again, I think we can look at history for a useful example. Before Ghash.io obtained it's 51% majority, back when it had about 35%, it used double spends to steal about $100,000 USD worth of bitcoin from gambling site Betcoin Dice.
The attack seems to have worked like this:
The attacker placed an on-chain bet.
If they won, they worked to confirm that transaction.
If the lost, they worked to confirmed an alternative version of the transaction that returned the money to themselves.
This effectively meant that the attacker won significantly more often than they should have by Betcoin Dice's probability expectations.
Back to your question, this was obviously not undetectable because I'm linking to a BitcoinTalk post about it---but it was something that didn't disrupt anyone outside of Betcoin Dice's operators, and it worried such a small part of the community that Ghash.io was later allowed to control a majority of hash rate despite this prior behavior.
(Note: Ghash.io claimed that the attackers had compromised them, and that the attack was not initiated by them even though it used their resources. I don't think it matters either way: I think it's an import historical example of the dangers of centralized mining.)
The attack above worked on unconfirmed transactions, which Betcoin Dice foolishly accepted at the time, but with a large share of hash rate, the attack can be reasonably attempted against even confirmed transactions.
An attacker with 35% of hash rate has a high chance of being able to reverse a single-confirmed transaction; plenty high enough to tip most gambling games in their favor enough to extract a large amount of value over repeated attempts. And reversing a single-confirmation from time to time can be somewhat hard to detect because one-block accidental forks (orphans/stale blocks) happen moderately often.
Nakamoto's Bitcoin paper says a 30% attacker can succeed at reversing 5 blocks 17.7% of the time, which is still plenty enough to give a reasonable edge in many low-margin online gambling games---although a 5-block fork would stand out in the stale block data.
The other attack a 51% miner, or even a 30% selfish miner, can perform is making stale any blocks the miner doesn't like. This can allow them to ultimately extend their 30% or greater control to 100%, ensuring they profitably receive all block subsidies and transaction fees.
A clever miner performing this strategy would make themselves look like multiple pools all below the danger threshold and would slowly put their competition out of business by not making too many blocks stale at once.
Alternatively, I've heard it proposed that they could help advocate changing the system in ways that would allow them to put other miners out of business much faster, such as by raising mining's fixed costs in way that they could easily bear as a large miner but which their smaller competition could not.
By using leverage and/or derivatives.
Same way some smart Wall Street contrarians made money on the housing bubble nearly a decade ago.
But even that won't get you success in a 51% attack on Bitcoin. Currently the cost of the attack likely involves producing your own chips, ... about $500M worth of them at the present time. So you aren't doing this attack successfully, "without detection".
But let's take a hypothetical attack on an altcoin, ... one with decent liquidity, and doesn't have a prohibitively large amount of protection from the amount of mining. Let's use Ethereum Classic ($ETC), for example.
So you hold $30M worth of $ETC for use in the attack. You then acquire control, for one day, of 3.2 Th/s (Ethash) ... about 100,000 GPUs, worth about $40M. Start mining your private fork. Spend that $30M of $ETC on the private fork to an address you control. This will be the double spending that you release later.
Send $10M $ETC to exchanges where you then buy positions that are short $ETC, somewhere in the 3:1 leverage range. Send the remaining $20M $ETC to the exchanges. Aggressively sell, converting to BTC, and withdraw. Slippage, though after dumping $ETC, might leave you with a bit less than the $30M of $ETC that you started with, so estimate retaining maybe 70% of the value, or about $14M. But then you sell/close your leveraged short position, making back maybe 200% profit (profit of $20M). Convert that initial $ETC capital and $20M gains to to $BTC and withdraw.
Then release the private fork which doubles spends, essentially reversing the $ETC the exchanges thought they received.
In summary here's your position:
Started out holding 1.7M $ETC (worth $30M). The $10M worth of $ETC sent to the exchange leveraged exchanges for shorting ended up returning $25M worth of BTC.
The $20M worth of $ETC sent to other exchanges for crashing the price ended up returning about $14M worth of $BTC.
After the attack is over, you have that $39M worth of BTC plus you still have the 1.7M $ETC you started out with at the beginning.
After a successful 51% attack, those might be worth just 20% of their pre-fork value. So that's maybe just another $5M of value.
What I didn't address was the cost of carrying out the attack. Perhaps renting 100,000 GPUs for the day cost $5M. Probably more. Who knows, it's never been done before, and probably impossible to execute. So maybe instead you'ld need to buy $40M worth of GPUs yourself.
So add that in, you needed $70M to carry out the attack ($30M of $ETC plus $40M to get the 100,000 GPUs).
After the attack is said and done you have $39M of BTC, $5M of $ETC, and $35M worth of GPUs ($5M lost as the box as these are now used GPUs).
That's not even a lousy 15% return on a $70M investment, assuming this is a one-and-done deal. And that's only if all exchanges allow your withdrawals in a timely fashion (withdrawing millions of $BTC can drain hot wallets and/or KYC checks imposing delays and/or account freezes). And if the short positions worked the way you had hoped.
And thus, this gives the explanation why we don't see 51% attacks performed for the purpose of cheating exchanges (yet).
If I had 51% of the Mining Power, I would not confirm any double-spend or otherwise fraudulent transactions. Rather, I would do honest mining (collecting all fees and rewards) with one minor twist:
Even with 51% of the CPU power, other miners would find blocks fairly regularly. But I could keep my blocks "secret" and only publish them as needed when other miners publish competing blocks. My blocks would have more miners working off of them, which invalidates the work of other miners and their chains. During the time that I keep my blocks secret, my miners would have a substantial headstart on mining future blocks.
From the perspective of Bitcoin Users, the system would still be trustworthy, but virtually 100% ALL fees and rewards would go to me, and other miners would go out of business.
I'd control the fee-basis, and gradually increase mining-fees. As long as I maintained 51% of mining power, I could even downsize my mining-pool and save on electricity costs, while collecting bigger fees.
